The CISO Dilemma - When Leadership Ignores Risks

What should a CISO do when the executive leadership chooses to ignore critical cyber risks? Well, this is the CISO dilemma, and the reality is a good CISO can do everything right within their power and still not be able to affect necessary change to manage critical risks. Now I was talking with Ian Thornton-Trump, and he's a CISO, and formerly he was with SolarWinds back in 2017. And you probably know this company SolarWinds, as they're currently in the center of the biggest US hack in recent memory. Their product has been compromised, and it pushed out a trojanized update to thousands of government and business customers with frightening possible damages. Now Bloomberg did an article and talked to Ian, and Ian in there in 2017 as an engineer, he raised some very critical issues when it came to cyber risks, and he presented to the executives. In fact, in the presentation, and it's quoted there, right? The survival of the company depends on internal commitment to security. And it really can't get any clearer than that. And I'd recommend going out to Bloomberg and reading this article. It's a good write-up on what he had to say and what people who came in after him had to say. And he ended up leaving shortly after essentially executives decided not to do anything. Right, so it's a good article. Go out and take a look. And that's what we're going to talk about today. We're going to talk about that CISO dilemma. What happens, you know, when CISOs find themselves in this position where they've done everything right and yet the executive, the C-suite, the board is just not interested, not interested in managing the risks, not interested in dealing or mitigating those critical risks that pose severe jeopardy to the organization and the goals and to everything else. So that's what we're going to talk about today. Then the first thing we really have to talk about is the roles of the CISO, because the CISO has to do everything right, and in some cases they don't. The The second thing we're gonna talk about is how the human mind actually deals with risk. How does the human mind disposition it? Because it's important when we're talking with executives and board members, really with anybody about risk, and there's really only 4 ways that we think about it. So we'll talk about that, and then lastly, I'm gonna give my recommendations based on talks that I've given and mentors, mentorships that, that I have with different CISOs out there. What do I recommend? We'll get into that. And hold on, because I'm also going to be asking something of everybody at the end, because I want to know your opinion on all of this. So first and foremost, we have to talk about the roles and responsibilities of CISOs, because if they're not doing it right, well, then it's probably no surprise that executive management or the board is not interested interested in investing in the right level of security. So first and foremost, a CISO is responsible for evaluating and quantifying both current and future risks to the organization. And this is not easy, and some CISOs fail at this. They will, for example, often look only internally. They will look at the vulnerabilities, known vulnerabilities, and they will develop a great vulnerability management program. That is necessary, that's an important part of cybersecurity, but it is not all-encompassing. It does not replace a cybersecurity strategy. It's only one component of it. And again, if you're not looking at the threats and the shifting attacks and the methods and objectives, and you're not looking about how everything is changing and the outside factors as well, well, you're just not doing a good enough job. And you probably won't be able to get the level of support because you won't have the whole story. The second thing CISOs need to do is they have to develop a reasonable plan, right? And what I mean by reasonable is it needs to be in alignment with the overall business goals. And yes, that's going to include risk, but it should also look at the opportunities because cybersecurity is here to enable the business to achieve those goals, to be successful, to bring in that revenue, to to expand its business, all those wonderful things. We're here to support that function by protecting the assets and capabilities and reputations and everything else. So if we look at it from that perspective and the story, the narrative is touching on both of those risks and opportunities, well, that's putting a better and more realistic picture out there for people to understand the relevance of it, and be able to get on board and help make that decision on what's the optimal path. Because again, you know, it's about finding that right balance when it comes to cyber risk. We never get rid of them all. We never eliminate risks. It would be either technically impossible or woefully too expensive or too impactful, right? We're always looking for that optimal set. You're going to hear me all the time talk about optimal security. It's about finding the balance between the acceptable risks, the cost to implement and sustain, and that friction that it introduces with users or support staff or maintenance or engineers. But understanding how those three interrelate and finding that right balance between the risk, the cost, and the friction is very, very important. And so the third thing that a CISO needs to do is they have to then communicate those risks and those recommendations with the executives and the board. And it has to be translated. In many cases, those executives and board members aren't security savvy. They don't know the lingo. They're not experts in risks. So this is an area that I see more often than not that CISOs fail at. They struggle with because it is really difficult, and many CISOs come up from a technical background, and the communication skills that's needed at this— the translation skills into— from risk and security into risk and business objectives is really difficult. But it's something that CISOs are asked to do more and more, both at the C-level and even up to the board. Many CISOs are asked to present to the board once or twice a year to educate them and, and kind of get buy-off on the direction and what that optimal level of risk really should be. Now, the fourth thing that a CISO does, well, they have to develop and institute a risk mitigation program based on what that agreed-to optimal balance is, and they have to be able to maintain it in alignment with evolving threats. So those are the 4 things that CISOs need to do, and if they're doing that and communicating well and getting it all done, and if they're still not getting buy-in, now they've got a problem. They've got a dilemma, because the human brain really only dispositions and responds to risk in 4 ways. First off, they deny it, and that's simply saying nope, The risk isn't there. I don't agree with it. Not gonna do anything about it. If the risk isn't there, there's no reason that I should invest or pay attention or anything else. I'm in denial. Not very healthy, generally speaking. The second method is we tend to accept things. And you'll hear this sometimes, well, there's nothing we can really do, or if the attackers really want to, I guess they'll do it, so I'm not gonna do anything. I'm just gonna accept all the risk. Now, acceptance is important actually, because again, you can't get rid of all risk. So well-informed organizations, as they're defining that optimal balance, there is a certain amount of risk that they're willing to accept, that they have an appetite for, the risk appetite, and that's okay. But when you get into the range where organizations are blindly just accepting the risk, or they're accepting such tremendous risk that it completely undermines the longevity of the corporation or the goals or the trust, things of that sort. That's in the red zone. So we want to keep it out of the red zone. We want to keep it where it's rational, where it's aligned, where you can have more controls. And that's really where we get into the third area of how people respond to risks., and that's to mitigate them, right? And that's a matter of putting controls in, and it's taking the risk from, you know, a high level and bringing it down to that acceptable level, that target, that optimal level. That's where you want to be. And the best organizations out there, this is what they're striving for. They know they're not going to get rid of all risk, but they've done that calculus to determine what the optimal level is, and they're putting controls in and holding the CISO accountable. Get us down to this level and keep us there, regardless of how the threats change or our business change, whatever. Keep us at this level. This is what we like. Okay? The fourth and final way is to transfer risk. And in the cyber world, we often see this with insurance. Unfortunately, it is not a silver bullet. We see many organizations decide, oh, I'm just gonna transfer the risk. I'm not gonna invest in a cybersecurity program. I'm just gonna buy some insurance. Now, insurance has its place. It can be very beneficial for certain situations, but by and large, it is not a comprehensive security strategy. It is something that is a piece of that puzzle that weaves into things, and it can be a good option for many organizations as a piece of their cybersecurity strategy, but it does not replace it. Unfortunately, many organizations don't see it that way. They're in denial, or they're just willing to accept, and I'm just going to transfer— in their mind, transfer all the risk, which doesn't really happen. Okay, so you've got 4 different ways people can deny it: they can accept it, they can mitigate it, and they can transfer it. And this is important because when organizations are well-informed, right, the CISO is doing their job, and they choose to either deny or just wholly accept way too much risk, right? It creates a serious dilemma for the CISO because basically what they're saying is we're not going to invest in security or risk management. Either we're going to ignore the risks, they just don't exist, we're going to deny them, or we're just going to accept them wholeheartedly. We don't even understand, but we're just going to accept. And It's a really tough position for a CISO to be in. And what can a CISO do, right? Well, they can accept it and do nothing. They can continue to collect paychecks, but they know that eventually very bad things are likely to happen. And when that comes around, all the fingers are going to be pointing at them. In fact, the whole reason they're probably collecting a paycheck is to be that person, that scapegoat, that person to blame when bad things happen. All right, that's not a good position to be in. The other option that's viable: you can leave. Now, if you've gone through and tried everything possible and worked your hardest to try and communicate, and they're just they're not going there, they're headstrong or they're in denial and they're entrenched. If you've done everything that you can, the other option is to walk away. And that's tough to do. It really, really is. That is a tough option to take. And every CISO has either experienced this or will experience it in their career, or they know somebody who has gone through this. I've gone through this. I've worked for a very large division before and went through and had to explain the risks and create, had to create entire new models and translate it into their language and convey it in a way they understood. And they were open about saying, hey, we understand it, and, but no, we're not going to invest in this. And unfortunately, it was about different perspectives. It was about certain denials. In many cases, it was, hey, that's not my problem, right? I'm just interested in profit over here. I don't want to invest in that. That's, that's somebody else's problem. Or denial. Ah, that'll never happen, right? I've talked with architects and engineers. Oh, my code is perfect, right? My product will never be used or misused, right? And they just are completely no matter what you present to them. And at the end of the day, after trying in these situations, I decided to walk. And it's a tough decision. I went to another business unit who was more rational and open. Bad things did happen. You know, I had to hold myself back and go, I told you, I told you so. You know, I was professional. I didn't do that, although I told you so. But, you know, when I talk with CISOs and I mentor many and colleagues, we talk about things like this all the time. And with CISOs I bump into at conferences and we strike up conversations on this topic, my advice is really simple. Act ethically. And if you aren't able to address significant risks, right, it's time to leave. Because it's important. We have a role, we have a function that we're here to do. We're here, and that role is not only defined within the organization, within the company, but also within the industry. We have a responsibility. We all know that. And when we lay our head down at night, and when we get up in the morning, and when we're looking at ourselves in the mirror, we want to know we're doing the right thing. And so listen to your gut. If you're in an organization that is not addressing these risks and is just paying you to stay around to be that scapegoat when something bad happens, Right? At the end of the day, something bad is gonna happen, and it's gonna be the shareholders, and it's gonna be the business partners, and the customers, and their customers who are ultimately gonna be victimized, who are gonna feel the pain, and you will have had a part in that. You don't want any of that. You don't want that on your conscience, not if you have a conscience. So act ethically, and if it's time to leave, it's time to leave, right? If you're not adding value, ultimately, then you're just the scapegoat. So my advice is professionally exit, move on, help another organization manage risk, continue to work in the industry because we have an important role. We have a role in making digital technology trustworthy, in supporting continued innovation, in helping great companies do wonderful things, and to help our society. So step up, do the right thing. That's my advice. Now, I'm thinking about inviting a few colleagues, perhaps even Ian, for a discussion. Maybe a panel of experts, maybe one-on-one. Let me know in the comment section if you would be interested in watching us discuss, debate, argue on this topic. Again, let me know in the comments, uh, and I'll see what I can pull together because I think it's a really interesting topic and everybody has a story and sharing and communicating makes us all stronger. So please let me know in the comments and as always, Hit the like button and subscribe if you want to hear more of Cybersecurity Insights.