How Travel Buyers and IT Managers Collaborate to Secure Sensitive Company Data

Global business travel spending reached $1.33 trillion in 2017 and is forecast to advance another 7.1 percent in 2018. As this investment continues to rise, it’s increasingly important to help business travelers protect sensitive company information while they are in transit. The cost of neglecting this risk is high, as a single data breach costs an average of $3.62 million.

Data Privacy

Travel buyers within large companies do more than negotiate supplier agreements. They set travel policies that can help reduce an organization’s risk. As such, both IT managers and travel buyers have an important role to play in data security. By coordinating efforts, they can ensure that business travelers are trained, equipped and updated on best practices to help keep personal and company information safe while traveling.

While most companies invest in IT security, a serious oversight in some companies is spending millions to protect their digital data while ignoring the threat of lower-tech hacking techniques. This risk is heightened for employees working while traveling, but it can be mitigated by educating travelers and providing resources to help protect data displayed on their screens.

The following are some measures designed to reduce the visual, verbal, digital and physical exposure of data, protecting key information and thwarting opportunistic hackers. These behaviors and tools can be incorporated into official practices and procedures by IT managers – and travel buyers can reinforce in communications.

Developing better situational awareness: Business travelers are their own first line of defense when it comes to data privacy and security. Whenever possible, they should try to position themselves in a way that limits what other people – or devices – can see, hear or record. They should consider multiple vantage points, including people above them (e.g., on balconies and upper levels) or within “zooming” distance, as well as the locations of security cameras.

Securing screens with privacy filters: Privacy filters help protect what’s on laptop or mobile device screens by blocking unauthorized side views – a particularly useful tool for travelers that spend a significant time in crowded waiting areas or in transit on planes, trains and ferries.

Locking devices when not in use: All computers and mobile devices should be password-protected as a basic security measure, but employees should be required to do so anywhere they access company information. This measure is only effective if they also make sure to lock the device whenever it is not in use – even for short periods of time.

Implementing physical locks and alarms: Physically locking briefcases and carry-ons provides an extra layer of security against opportunistic snatch-and-grab incidents. In addition, laptop alarms are available that combine software with a physical alarm attached to the device. If the device is lost or stolen, the alarm goes off loudly.

Traveling with juice-jack protectors and personal charging devices: Juice-jack protectors can be attached to the end of a USB cord to help protect against skimmers when travelers are charging their devices in public places. If possible, providing personal charging devices to frequent travelers will limit their need to use public chargers at all.

Using portable Wi-Fi hotspots and/or a company VPN: Open or publicly-available Wi-Fi leaves travelers vulnerable to numerous methods of hacking. Ideally, frequent travelers should have their own personal hotspot device to access their own Wi-Fi, but a company VPN can also provide greater protection on an open network […] Read more »..

 

The role, the challenges and the responsibilities of a CIO with Milos Topic.

Apex sat down with Vice President & Chief Information Officer of Saint Peter’s University. With 20 years of experience in leadership, innovation strategies, technology implementation and business development, Milos shares his views on the role of a CIO and  what it means to be an IT leader today.

 

Q: What is IT doing to support innovation?

A: IT is meant to drive innovation and enable others to do the same and take part. IT is a critical partner and a “golden thread” if you will across everything modern businesses and organizations do. As such, it is uniquely positioned to provide value to all.  Furthermore, innovation comes in many forms, but it always requires action. Thinking, planning, strategizing is all wonderful and valuable, but without action, not much will get accomplished.

Q: What is the single most important thing CIOs should be focusing on today?

A: CIOs as well as all executives should be focused on people and business growth. Modern CIOs are more customer facing and are spending time on strategy, vision and innovations across and beyond the enterprise.

Q: Should IT be a business enabler?

A: IT is business in a sense, or it is at the very least an essential part of every modern and competitive organization. As such, it should provide options to challenge old (and at times outdated) business models before others (from the outside) do it for them.

Q: How do you stay abreast of the trends and what your peers are doing?

A: I have invested years (and continue to do so) in building and nurturing relationships across various industries, sectors and markets. These relationships paired with various events (such as those hosted by Apex) are of critical significance in staying current and learning from those who may be further along.

Q: What is the biggest challenge for a CIO today?

A: It varies across industries and different maturity models of organizations, but I do believe that attracting and retaining top talent is one of the largest priorities, it certainly is for me. In today’s world and in major markets such as greater New York City area people have options which is great for them, yet challenging to many organizations.

Q: What is the difference between a CIO and a CTO?

A: Titles vary, but in general, a CIO should be focused on customers, innovation, strategy, growth and providing value to other major areas (Finance, Marketing, Operations, Security, Legal…) while a CTO is leading the existing services and ensures smooth operations of teams.

Q: How has the role of the CIO changed over your career?

A: Visibility has increased, and so have the responsibilities. CIOs have now earned seats on top management teams among their executive leadership peers. They are also more involved in the overall business vision, strategy and direction than ever before. All of these changes have taken place across organizations that are current and future proofed, while others are still behind and are struggling across some of these areas.

Q: What advice would you give an early stage CIO joining an organization?

A: Get as close to the business as you possibly can and learn everything about it. Build relationships, provide value to others and always give more than you take, in every exchange. Spend time and resources on developing leadership, strategy and negotiation skills as they matter in all that we do, professionally and personally.

Q: How important is the relationship between a CIO and a CISO?

A: While the reporting structure is debated by some, the relationship is very important. CIO relationships with everyone they work with are of importance, from CISO, to CFO, CMO, COO…all the way to the CEO. The entire C-suite needs to be unified and transparent with each other in order for all of them to move forward and make progress.

Q: What is the largest obstacle a CIO faces when it comes to security?

A: People. Training and organizational requirements to how data is stored, used and shared. Furthermore, many organizations are not funding information security adequately and proactively.

Q: What falls under the CIO’s responsibilities when it comes to security?

A: I’m of the belief that there should be one top technology leader and that is a CIO. Everyone else should report to them with varying degrees of authority. When it comes to finance, marketing, legal…they are all ultimately under one leader while IT seems to be fragmented in some organizations. The only potential exception is an area responsible for the overall risk, liability and governance for the entire business…they could be outside IT with strong collaborative partnership with the CIO and their leadership team.

Q: How do you see the security landscape changing over the next 12 – 18 months and how are you preparing?  

A: Robots are taking over. From machine learning to artificial intelligence, people can’t keep up with the volume and complexity of threats so continuous investments in tools and technologies is expected. We are experimenting with robotic process automation (RPA), machine learning and will continue to stay current with what is available.  

Q: How worried are you about the “human element” when it comes to security?

A: It is the weakest link in this chain. People make mistakes in opening emails, sharing data, configuring technology (both software and hardware)…the list goes on. Cyber security awareness training should be mandatory across all organizations and should be part of one’s employment record at some point in time.

 

Milos Topic

Vice President & Chief Information Officer

SAINT PETER’S UNIVERSITY

I believe that everything begins and ends with leadership. Leaders have the greatest responsibility for the impact and influence over the people they lead and the outcomes of their organizations as a whole. Furthermore, I am passionate about IT being a trusted strategic partner and an advisor (a service broker) to the entire organization as technology must drive innovation across organizations and provide both strategic and operational business solutions.

I have 20 years of experience in leadership, innovation strategies, technology implementation & business development while my formal education is a blend of science, technology and business. My journey in the Information Technology (IT) profession started in 1997 and over the past 20+ years I have worked on nearly all aspects of IT. I got underway with networking/cabling installs; tech support to programming in C++, C#, Java; web development; system/network security/administration to my most recent positions of leading teams of amazing people providing technology solutions and services while supporting a multitude of organizational needs. Finally, it is essential to always focus on people first, as they matter the most in everything we do.

Sara Nunez: Being a Woman In Technology

Apex sat down with Sara Nunez, award-winning global Program Management executive. With her experience transforming organizations by applying a broad range of integrated strategic execution best practices and business development initiatives, she shares her thoughts on being a Woman in Technology. 

Q: Is the lack of women in tech really a pipeline problem or is that companies are not providing the culture to cultivate and promote their women talent?

A: We need to do research on this topic. There are many factors to this challenge. 1. We were created with special attributes, just as men were created.  2. Society and Cultures have a lot to do with this issue as well. 3. We need women to unleash their potential without looking at this as competition with men. Companies are us people, therefore, it is our duty to transform and enable success with the right mix of people required regardless of them being women or men.

Q: Does the current conversation about women in tech single women out and leave men out of the solution in your organization?

A: The current conversation is needed and I do believe it is a concern for both sides.

Q: What can organizations do to get more women into senior level and executive positions? Where do you see gaps?

A: Companies are looking for talent and new skills.  We need more qualified women with thick skin to be leaders and apply for senior level positions.

Q: What can companies can do to address unconscious bias at all levels of the organization?

HR and hiring programs should measure the desired outcome and strategize to make it happen.  A balance and diversity is critical for organizations around the world.

What advice would you give to a woman considering a career in the tech industry? What do you wish you had known?

A: My mentor once told me, if you love what you do, you will be amazing at it.  If you are considering a career in the tech industry you have to love it, be an expert at it.  Spend extra time to go beyond.  You are not competing with men, you are complimenting them and together as a team you will succeed.  Be you, be a woman.

Q: What do you think is the biggest challenge for the next generation of women and how can we be stronger role models for them?

A: I think the biggest challenge is to keep up with rapid technology changes and the ability to create knowledge rather than looking for it.  Writing articles and visiting universities to share your knowledge with a new generation could give us the platform to prepare them to succeed.  We need to pay forward and push them hard.

Q: How is your organization creating programs and training for men to be better advocates for women specifically around support and sponsorship?

A: Multiple programs are in place, from Leadership Dev Programs and global assignments to mentoring and sponsorships.

Q: How can women better support other women in technology?

A: We need to excel and inspire women to follow the steps and make giant moves to be recognized and valued for who we are.

Q: It is no secret that many women in the tech industry have felt their gender has affected the way that they are perceived or treated in their role. Have you come across a situation that made you feel that way?

A: Do not allow that to happen.  We are in a company to drive results and motivate each other to succeed.  We are ONE.

 

Sara Nunez, IT Enterprise PMO Director

Dynamic, award-winning global Program Management executive and advisor to the C-suite who ensures strategic PMO is embedded throughout the enterprise’s DNA. Transforms organizations by applying a broad range of integrated strategic execution best practices and business development initiatives. Drives organizational goals, improves performance and efficiencies, and capitalizes on revenue-generating opportunities. Generously shares expertise to inspire a passion for learning, creating high-performance teams with intellectual and emotional connection to their work. Agile and multicultural, with expertise across a broad range of industries including telecommunications, technology, wealth management, and education.

Global Talent Shortage is Top Emerging Risk Facing Organizations

Staff shortages have escalated in the last three months to become the top emerging risk organizations face globally, according to Gartner, Inc.’s latest Emerging Risks Survey.

“Organizations face huge challenges from the pace of business change, accelerating privacy regulations and the digitalization of their industries,” said Matt Shinkman, managing vice president and risk practice leader at Gartner. “A common denominator here is that addressing these top business challenges involves hiring new talent that is in incredibly short supply.”

Table 1. Top Five Risks by Overall Risk Score: 1Q18, 2Q18, 3Q18, 4Q18

Rank 1Q18 2Q18 3Q18 4Q18
1 Cloud Computing Cloud Computing Accelerating Privacy
Regulation
Talent Shortage
2 GDPR Cybersecurity
Disclosure
Cloud Computing Accelerating Privacy
Regulation
3 Cybersecurity
Disclosure
GDPR Talent Shortage Pace of Change
4 Global Economic
Slowdown
AI/Robotics Skill Gap Cybersecurity
Disclosure
Lagging Digitalization
5 Social Engineering Global Economic
Slowdown
AI/Robotics Skill Gap Digitalization
Misconceptions
 

Sixty-three percent of respondents indicated that a talent shortage was a key concern for their organization. The financial services, industrial and manufacturing, consumer services, government and nonprofit, and retail and hospitality sectors showed particularly high levels of concern in this area, with more than two-thirds of respondents in each industry signaling this as one of their top five risks.

Gartner research indicates that companies need to shift from external hiring strategies towards training their current workforces and applying risk mitigation strategies for critical talent shortages.

“Organizations face this talent crunch at a time when they are already challenged by risks that are exacerbated by a lack of appropriate expertise,” said Shinkman. “Previous hiring strategies for coping with talent disruptions are insufficient in this environment, and risk managers have a key role to play in collaborating with HR in developing new approaches.”

Talent Shortage May Exacerbate Other Key Risks

Beyond a global talent shortage, organizational leaders are grappling with a series of interrelated risks from a rapidly transforming business environment. Accelerating privacy regulation remained a key concern, dropping into second place in this quarter’s survey. Respondents indicated that the pace of change facing their organizations had emerged as the third most prominent risk, while factors related to the pace and execution of digitalization rounded out the top five emerging risks in this quarter’s survey.

Mitigation strategies to address this set of risks often come at least partially through a sound talent strategy. For example, a key Gartner recommendation in more adequately managing data privacy regulations is the appointment of a data protection officer, while both GDPR regulations and digitalization bring with them a host of specialized talent needs impacting nearly every organizational function.

“Unfortunately for most organizations, the most critical talent needs are also the most rare and expensive to hire for,” said Shinkman. “Adding to this challenge is the fact that ongoing disruption will keep business strategies highly dynamic, adding complexity to ongoing talent needs. Most organizations would benefit from investing in their current workforce’s skill velocity and employability, while actively developing risk mitigation plans for their most critical areas[…] Read more ».”

 

 

Insights from Founder and President of StarCIO with Isaac Sacolick

Apex sat down with Isaac Sacolick, Founder and President of StarCIO. As a successful CIO who has led digital transformation, product development, innovation, agile management, and data science programs in multiple organizations, he sheds some light on challenges and focus areas for today’s CIO.

Q: What is the biggest challenge for a CIO today?

A: CIOs have the challenge of evolving IT from back office support functions to ones that can deliver applications and analytics while investing in agile, cloud, devops, and security. Many of the CIO I talk to are still adjusting to the speed, innovation, and organizational intelligence required to remain competitive and to avoid disruption.

That’s all table stakes today.

CIOs have to see what’s coming next for their businesses and drive discussions on where they can lead their industries. They have to identify partnerships, experiment with new technologies, and accelerate the development of their leadership teams so that they can deliver and iterate on differentiating capabilities. That’s a lot to do, when many organizations have cultures resistant to change, legacy technology footprints, increasing security threats, and greater operational impacts when technologies underperform.   

Q: What is the single most important thing CIOs should be focusing on today?

A: I think that CIO can’t just have a single most important thing as it can lead to saying ‘no’ to business opportunities, underserving parts of the business, or overinvesting in a strategic driver whether it be innovation, operational excellence, compliance, etc.

Some time ago, I wrote how digital CIOs manage their time and it resonated with many CIO that struggle with their shifting roles and juggling many priorities. The biggest thing the CIO should focus on today is how to manage their time, find partnerships, and grow bench strength to meet these challenges.

Q: What is IT doing to support innovation in the enterprise?

A: IT should start by defining an ideation process and pipeline that captures new ideas from across the organization and puts them through rapid discovery processes. I describe these pipelines and planning processes in my book, Driving Digital: The Leader’s Guide to Business Transformation Through Technology along with agile transformation, product management, and becoming data driven – all practices that drive innovation.

Second, I recommend to CIO and their leadership teams to spend significant time out of their IT offices and seek to develop business relationships, visit customers, and attend various industry events. IT can’t drive innovation without having an outside-in perspective on what customers need, how business leaders are managing competitive threats, and how other industries are solutioning comparable challenges.

Lastly, IT should be doing a lot of experimenting, executing proof of concepts, and investing in learning activities. To be innovative, IT needs to know how to integrate different technologies into nimble, supportable solutions. There’s no silver bullet to innovation, and IT has to invest in learning the building blocks.

Q: How do you stay abreast of the trends and what your peers are doing?

A: I have a voracious appetite for reading, writing, speaking, meeting people, attending events, and participating in social media. I’m a bit of an outlier as a big part of what I do now at StarCIO is advise leaders on transformation, collaborative practices, platforms, and emerging technologies.

I also get hands on with new technologies from time to time.

IT leaders should try to do the same. Read two or more articles a day, a book a month, and attend at least three conferences yearly. Find a comfort zone participating in social media such as commenting on selective posts, participating in a Twitter chat, or writing a guest blog post. Most SaaS solutions offer trials and demo accounts, so invest some time to roll up the sleeves and see what works.   

Q: What advice would you give an early stage CIO joining an enterprise organization?

A: CIOs have to run in several parallel directions when joining an enterprise. First, significant time should be spent with business leaders to start developing relationships and ideally with customers to better understand how the organization’s products or services impact them. Second, they should conduct an end to end assessment of their department’s capabilities, strengths, and weaknesses along with a review of underlying practices and technologies. Finally, they should select a handful of departments that have strategic priorities and may be underserved technically.

CIOs in their first hundred days should be looking to answer several questions. Where are the strategic priorities where technology can make an impact? What are some quick wins and other initiatives that need to be on the roadmap? What major risks have not been communicated or don’t have mitigation plans? What are the gaps in IT that the CIO needs to address and may need financial help, collaboration, or forgiveness in their early goings? What areas of the organization are early adopters to new practices and technologies versus others that are slower to change or others that may be detractors?

CIO roles have to pull this information together quickly to formulate and communicate a go-forward strategy and plan.

 

Isaac Sacolick (@NYIke) is the Founder and President of StarCIO, a services company that helps clients succeed with data and technology while executing “smarter, faster, and more innovative” transformation programs. Isaac is a successful CIO who has led digital transformation, product development, innovation, agile management, and data science programs in multiple organizations. He is the author of the Amazon bestseller, Driving Digital: The Leader’s Guide to Business Transformation Through Technology, and has written over four hundred articles as a contributing editor at InfoWorld,  CIO.com and Social, Agile and Transformation. He is an industry speaker on digital transformation, becoming a data driven organization, artificial intelligence, agile management, and other leadership topics. Isaac has  been recognized as a top digital influence by IDG, Enterprise Management 360, and Thinkers360, a top 100 CIO in STEM, a top social CIO by HuffPost, Forbes, and HP Enterprise.

Philadelphia University’s Cybersecurity Program Receives “Top Curriculum” in the US

OnlineMasters.com, an industry-leading educational research organization, has named La Salle University’s Master of Science in Cybersecurity a top 25 internet security program for 2019, and also awarded the program “best curriculum.”

OnlineMasters.com analyzed every online master’s program in internet security in the nation with a team of 43 industry experts, hiring managers, current students and alumni.

According to OnlineMasters.com, the study leveraged “an exclusive data set comprised of interviews and surveys from current students and alumni in addition to insights gained from human resources professionals.” Their methodology weighted academic quality (academic metrics, online programming, and faculty training and credentials) at 40 percent, student success (graduate reputation, student engagement, and student services and technology) at 40 percent, and affordability (average net cost, percent of students with loans, and default rate) at 20 percent. The study incorporated current data from the Integrated Postsecondary Education Data System (IPEDS) and statistical data from the National Center for Education Statistics. Only programs from accredited nonprofit institutions were eligible.

“We are honored to be recognized as a top 25 internet security master’s program, with a special nod to our curriculum,” says Peggy McCoey, assistant professor and graduate director for La Salle’s M.S. in Cybersecurity. “We have developed a flexible, rigorous, and highly relevant program to ensure today’s students develop competencies in cybersecurity management as well as breach detection, mitigation and prevention. The Program balances both theoretical and practical aspects and draws key learnings from industry practitioners to ensure attention to ethical principles and changes related to cybersecurity.”

La Salle’s M.S. in Cybersecurity is a 100 percent online asynchronous program with three start dates and eight-week courses so students can complete two courses per semester. OnlineMasters.com noted its “engaging courses in cyberwarfare, cybercrime and digital forensics” in support of its “best curriculum” designation[…] Read more ».

 

 

Is Your Data Breach Response Plan Ready?

Fifty-six percent of organizations experienced a data breach involving more than 1,000 records over the past two years, and of those, 37 percent occurred two to three times and 39 percent were global in scope, according to Experian. In 2017 in particular, there were more than 5,000 reported data breaches worldwide, and there were more than 1,500 in the U.S. alone.

In an effort to help businesses prepare for data breach response and recovery, Experian launched its new Data Breach Response Guide last month to provide in-depth strategy and tactics on how to prepare and manage incidents.

Security asked Michael Bruemmer, Vice President of Data Breach Resolution & Consumer Protection at Experian, how cybersecurity has changed recently and how enterprises can revamp their security strategies to be resilient and ready.

Security: How have typical responses to data breaches changed over the past five years?

Bruemmer: Fortunately, responses to data breaches are immensely better. There has been great progress in preparation, as 88 percent of companies say they have a response plan in place compared to just 61 percent five years ago, according to our 2018 annual preparedness study with the Ponemon Institute.

One of the biggest changes in data breach responses over the last few years is that organizations now have a breach-ready mindset and know it’s not about whether a breach will happen but rather when it will occur. Thus, many organizations now have a data breach response team in place, which is key to implementing a quick and adept response.

Businesses have also started to include public relations personnel on their data breach response teams, which has helped companies maintain more positive relationships with their stakeholders post-breach. There is still room for improvement: while companies have a plan in place, a large majority don’t practice their plans in a real-life drill setting, and the C-suite and boards are still not engaged enough in the process.

Security: What still needs to occur to improve enterprises’ data breach response protocols and practices?

Bruemmer: A few areas for improvement include actually practicing the data breach response plan and therefore, feeling confident the company can handle an incident successfully. In our 2018 annual preparedness study, only 49% of companies said their ability to respond to data breaches is/would be effective. One of the reasons may be that most boards of directors and C-suite executives are not actively involved in the data breach prep process, nor are they informed about how they should respond to an incident.

Another dynamic that requires attention, and is relatively new, is the passing of the General Data Protection Regulation (GDPR) overseas. Companies that operate internationally must understand the legislation and make sure they are equipped to handle a data breach that involves individuals globally. They should hire legal counsel who have knowledge and experience in this area and enlist partners that have multilingual capabilities and a presence in key countries. That way, operations such as notifying affected parties and setting up call centers can be executed quickly. Organizations are still catching up here.

Security: When auditing their data breach response plan, what in particular should security leaders be looking for?

Bruemmer: Businesses should conduct an audit of every component of a response plan. Security leaders should also assess whether external partners are meeting the company’s data protection standards and are up-to-date on new legislation. For example, healthcare entities should guarantee that business associate agreements (BAAs) are in place to meet the Health Insurance Portability and Accountability Act (HIPAA) requirements. Additionally, vendors should maintain a written security program that covers their company’s data. Realistically, an organization could have up to 10 different external vendors involved in a data breach response, so keeping this circle secure is important.

Security: What are the top three issues business security leaders should plan for next year?

Bruemmer: Businesses should keep an eye on artificial intelligence (AI), machine learning (ML) and cryptomining malware next year. In a continuously evolving digital landscape, advanced authentication, or added layers of security, have become increasingly important for businesses to adopt when it comes to safeguarding against potential data breaches. However, while AI and ML are helpful in predicting and identifying potential threats, hackers can also leverage these as tools to create more sophisticated attacks than traditional phishing scams or malware attacks. Criminals can use AI and ML, for example, to make fake emails look more authentic and deploy them faster than ever before. Cryptomining has also become more popular with the recent rise of Bitcoin and more than 1,500 different cryptocurrencies in existence today. Cybercriminals are taking every opportunity, from CPU cycles of computers, to web browsers, mobile devices and smart devices, to exploit vulnerabilities to mine for cryptocurrencies.

Security: Are there any key tools or strategies security leaders can use to better engage with the C-Suite?

Bruemmer: Unfortunately, the lack of engagement by the C-suite and boards seems to be an ongoing issue. In today’s climate, companies should employ a security leader in the C-suite such as a Chief Information Security Officer to ensure protection is a priority and administered throughout the organization.

There should be ongoing and frequent communication about security threats by this officer to leaders and the board. In this instance, it’s better to over-communicate rather than hold back vital information that could help mitigate potential reputation damage and revenue loss […] Read more »

 

 

 

From a birds eye view of a CSO with Ian Amit

Apex sat down with Ian Amit, Chief Security Officer of Cimpress to discuss his views on what it means to be an innovative CSO today while remaining a business enabler. With over a decade of experience in diverse security fields he shares his experience and advice.

Q: What is IT security doing to support innovation in the enterprise?

A: First and foremost, ensuring that security understands the business needs as far as direction (technologically) and strategy. Then security complements said strategy and not only ensures it is taken through secure means, but also further enables it to take additional risks.

Q: What is the single most important thing CISOs should be focusing on today?

A: Understanding and prioritizing the risks for the business. It’s not a question of a technological vulnerability “du jour” to be addressed (especially if it does not affect the organization’s threat model) and more about being able to correctly utilize the resources at hand to most effectively address the actual relevant risks.

Q: How can you best describe the relationship between the CIO and the CISO in the enterprise?

A: Independent. The CIO and CISO have potential conflicting views when it comes to technology, and hence should be independent of each other.

Q: Should IT security be a business enabler?

A: Absolutely. IT Security should never come from a “NO” approach, and by definition should enable the business to pursue whatever course of action it deems the most beneficial.

Q: How do you stay abreast of the trends and what your peers are doing?

A: Beyond the continued technological education, working and engaging with peer CSOs and CISOs has been the most beneficial for me as far as keeping up with the news, and mostly around how other executives are meeting their challenges. Forums where there are curated discussions where the members drive the conversations have been the most effective in doing that.

Q: How have you searched for and found the best vendors for your organization?

A: It is a constant cycle of looking for the right vendors for the organization, and in my view the value of VARs have diminished significantly over the years and are only used to secure the best price point for a product. For me the focus on products is shifting, and I’m spending more on training my internal resources, while augmenting them with the right products. That means continuously challenging our operating model, and also the products we use.

Q: What is the difference between a CISO and a CRO (Chief Risk Officer)?

A: There is definitely a lot of overlap from my perspective, and I feel like a CRO is only applicable in organizations where the majority of the risk contains not only non-information elements, but is highly biased to financial or legal elements. In more “traditional” organizations, I believe that a CSO (who has all security in scope, not just information security) is the executive role responsible for risk overall, and can be coupled with a strong internal audit function to provide full risk management coverage for the organization.

Q: How has the role of the CISO changed over your career?

A: At the beginning of my career, CISOs were mostly IT-Security managers. The scope and focus of those roles has been mostly limited to technology risk and managing the security of the infrastructure and the technology stack. Modern CISOs, and especially CSOs are tasked with a broader scope which includes the social as well as physical elements of security of the organization.

Q: What advice would you give an early stage CISO joining an enterprise organization?

A: Communication is key. Being able to have discussions with your peers in the executive management is critical, and this includes learning to formulate risk in business terms. Only then the application of “our” domain knowledge becomes applicable. One of the most common mistakes I’m seeing with CISOs in general is gravitating back to the engineering-heavy comfort zone where a lot of them came from, while losing focus over the actual missions which is to secure the organization and enable it to advance.

 

Discussions with Malik Bernard on the pathway to cyber success

 

Apex sat down with Malik Bernard, Executive Head, Cyber Governance (Cyber Security and GRC) at the City of New York to discuss the cyber journey. With over 20 years overall in the space of Cybersecurity, Enterprise IT Strategy and Design, Vendor Management coupled with IAM and DLP program implementation, he shares his experience on the pathway to cyber success.

Q: What is IT security doing to support innovation in the enterprise?

A: This is an interesting question; On its face, a simple question; but if you give it some thought, there has to be a distinction between IT Security and  how it supports Cyber. Within IT Security, one may look at Data, Hardware/Software and Artificial Intelligence. I know from performing hands on labs, working with industry leaders, and analysts, the trend is towards

  • Hardware Authentication
  • Machine Learning coupled with Behavior Analytics
  • Cloud Security or should I say, better cloud security, beyond Firewalls, Storage etc. In this space, virtualization still rules and the implementation of Virtual IPS/IDS is paramount as part of an overall Cloud security strategy.

Q: Should IT security be a business enabler?

A: Everyone and every department, should support the business through smart hiring, defined, well documented processes and procedures and with appropriate technologies.

Q: How do you stay abreast of the trends and what your peers are doing?

A: I listen to smarter people than myself. I have within my circle of whom I trust, those that are non-bias individuals who aren’t afraid to tell me no, share with me what they really think and I attend a few workshop forums yearly to challenge and stretch my knowledge.

Q: How have you searched for and found the best vendors for your organization?

A: It helps to be the SME or subject matter expert or know a few on a variety of business and tech needs. This way, you can cut through the ‘pitch’ and get to the ‘how will this help solve the challenge(s) we’re currently facing’ and how will it scale.

Q: What is the biggest challenge for a CISO today?

A: This one depends on many factors; The size of the organization; The amount of power and control trusted and given to the CISO. I would say, keeping up with the ever changing attack surface of the enterprise and ensuring that one’s defensive posture, is the ‘right size’ for their environment.

Q: What is the difference between a CISO and a CRO (Chief Risk Officer)?

A: CISOs are more focused on tech, cyber, etc. CROs are more focused on Risk, Threats etc. They both should work closely together to ensure a full 360 view of Risk and Threats across the landscape.

Q: How has the role of the CISO changed over your career?

A: I’ve actually changed and defined in my prior role, what a next generation CISO should be focused on and how to get quick wins, towards a sustainable strategy of measured success. This role simply validated what I’ve been doing in prior, non exec, C-Suite positions.

Q: What advice would you give an early stage CISO joining an enterprise organization?

A: Discern what’s real, what’s perceived and what’s noise. Find a way to cut through the ‘pitch’ and understand how x may occur and have in place, 2, 3 options at the ready to defend the organization. Finally, listen more, speak less and be curious.

 

Mr. Bernard is the Senior Executive Head of the City of New York, where he heads up the City’s Cyber Governance Tower. He was also in charge of leading the following domain areas: Software Security Assurance akin to SDLC, Cybersecurity and Awareness Training and IT Risk.

Prior to joining the City of New York, Mr. Bernard held the role of Chief Information Security Officer (CISO), for a global technology company, where his and his team’s focus was on Cybersecurity (Identity Access Management, Data Leakage Prevention, Threat Management, GRC and Privacy Management.)

 

Security Budgets Increasing, But Qualified Cybertalent Remains Hard to Find

The worldwide cybersecurity skills gap continues to present a significant challenge, with 59 percent of information security professionals reporting unfilled cyber/information security positions within their organization, according to ISACA’s cybersecurity workforce research.

According to the report,

  • High likelihood of cyberattack continues. Four in five security professionals (81 percent) surveyed indicated that their enterprise is likely or very likely to experience a cyberattack this year, while 50 percent of respondents indicate that their organization has already experienced an increase in attacks over the previous 12 months.;
  • Nearly 1 in 3 organizations (31 percent) say their board has not adequately prioritized enterprise security.
  • Men tend to think women have equal career advancement in security, while women say that’s not the case. A 31-point perception gap exists between male and female respondents, with 82 percent of male respondents saying men and women are offered the same opportunities for career advancement in cybersecurity, compared to just 51 percent of female respondents. Of those surveyed, about half (51 percent) of respondents report having diversity programs in place to support women cybersecurity professionals.
  • Individual contributors with strong technical skills continue to be in high demand and short supply. More than 7 in 10 respondents say their organizations are seeking this kind of candidate.

Yet, there are several positive and promising insights in the ISACA data:

  • Time to fill open cybersecurity positions has decreased slightly. This year, 54 percent of respondents say filling open positions takes at least three months, compared to last year’s 62 percent.
  • Gender disparity exists but can be mitigated through effective diversity programs.Diversity programs clearly have an impact. In organizations that have one, men and women are much more likely to agree that men and women have the same career advancement opportunities. Eighty-seven percent of men say they have the same opportunities, as compared to 77 percent of women. While a perception gap remains, it is significantly smaller than the 37-point gap among men and women in organizations without diversity programs (73 percent of men in organizations without diversity programs say advancement opportunities are equal, compared to 36 percent of women).
  • Security managers are seeing a slight improvement in number of qualified candidates.Last year, 37 percent of security professionals said fewer than 25 percent of candidates for security positions were sufficiently qualified. This year, that number dropped to 30 percent.
  • Budgets are increasing. Sixty-four percent of respondents indicate that security budgets will increase this year, compared to 50 percent last year […] Read more »