They Said a CISO Does What?

The cybersecurity industry has challenges with bringing in new blood and facilitating the career growth. Misinformation has unfortunately played a part in making various roles appear unattainable when we should be doing the opposite. We should be embracing the flexibility, identifying opportunities, and most importantly of all, discussing realistic expectations and roles. Now, I recently stumbled across an article that lists the qualifications for Chief Information Security Officers, CISOs, and I was shocked at the inaccuracy. I think many great candidates who read that would likely be turned off by this, and others who do have the skills listed would probably be surprised in how that they're really not applicable to the CISO role. So let's take a look at a few of the concerning qualifications in this article. As you can see, this article is geared towards people who are interested in becoming a CISO, and it's supposed to tell you what you need to know. Now, under the qualifications here, this is going to be the first area I pick on: understanding of SMTP, DNS, HTTP, IP network routing, VPN, and other technologies? Well, yes, you need to understand what they are, but you don't need to have a deep understanding of those. Uh, in fact, you're really confusing us, the CISOs, with network engineers and architects. Now, the CISOs, we do need to know what these protocols and language and tools and architectures are and in general how they're used, but we would not likely be qualified to design these, configure, write these kinds of things, or troubleshoot, and especially determine if specific nuanced aspects of them are being abused by an attacker. That's why we leverage specialized technical experts like those network engineers, architects, and coders to really understand what the configuration and be able to do comprehensive inspections when things aren't going right. So these are important technologies. They're typically part of infrastructure that needs to be protected. But no, the CISO does not need to be experts in these areas. Another place here that I'm gonna call out is understanding the, you know, DMCA, trademark, IP, safe harbor provisions, which is around privacy. So is GDPR and other federal international legal precedents, regulations and so forth. Yes, the CISO does need to know what these are in general, but these are legal documents. These are very specific regulations that need a high degree of expertise. CISOs don't have that typically. We do leverage our very close partners though, and those are the attorneys, the lawyers, the privacy experts. Who do bring the right level of understanding, interpretation, and expertise in all of these areas to bear. So we partner with them, but because even a small error can become a big problem, CISOs aren't the ones that are the experts. We simply know that these are part of the environment. They're part of the business environment. They're going to determine a lot of the cyber ethics, and they're going to be tied into policies and, and so forth. But no, we do not need to be experts in these areas. Now, the last one on this list right here really kind of made me laugh. No, a CISO does not spend their time reading and analyzing logs. I don't know of a single peer that spends their day doing this. It's important. It's typically, um, the role of an operational analyst, you know, a level 1 or maybe a level 2 analyst to be able to look at those logs and determine anomalies and follow up on things and, and open up tickets and, and whatnot. This is not what a CISO does. Any CISO that's doing this, either one, really isn't a CISO, two, has way too much time on their hands and they're bored and maybe they just like to do this, or three, they are woefully misusing their valuable time, because this is not what CISOs do. CISOs are leaders. We communicate and set expectations. We understand risks and we manage those. We communicate upwards and laterally and downwards, and we understand that blending of technology, behaviors, and process that combine to create a risk environment. So the very last thing I'm going to call out— actually, I'm going to scroll up here a little bit. Is really around creating a framework, right? Risk-free and scalable for changing business landscapes. Risk-free. I, I hate to break it to you, but no, we do not eliminate risk. Sorry to say, CISOs do manage risk. In fact, we We manage risk to an optimal level. We help define what that acceptable level of risk for an organization is based on the security, the cost, the friction that it would add. Find that optimal target, and that's what we manage to. The reality is, A, it's technically impossible to eliminate risk. It's just not possible. And B, if it were possible, it would be so expensive and impactful and just dragging the company down and the capability of doing anything, that nobody would want it. So no, strike this, we do not eliminate risk or make risk-free operations. It's just not realistic. Honestly, who writes this stuff? The reason I'm calling this out is because misinformation is harming our industry by setting inaccurate expectations. We must clean up job descriptions and clarify the actual roles and responsibilities of positions. Otherwise, we become a detriment to the next generation of cybersecurity professionals, and we hurt the overall security, privacy, and safety of new technology. Thanks for watching. If you like these cybersecurity videos, please click the like button, leave a comment, and subscribe to the Cybersecurity Insights channel. I put out a video about every week on various cybersecurity topics, risks, ideas, events, and best practices. Let's continue to communicate and collaborate together. That's how we make cybersecurity strong in protecting the global digital ecosystem.