|
 |
|
|
|
Inspired by the reporter.lu 2021 review, I have adapted a quote by the investigative journalist Hans Leyendecker to my role as Chief Information Security Officer (CISO) in my New Year’s greeting: ‘A good CISO is an unsatisfied CISO. No one who is completely satisfied is capable of implementing security’.
This sentence has comforted many internal and external CISOs I have worked with in 2021: Guillaume, Ingo, Laura, Marc, Matthieu, Patrick, Yannick…
We often feel like a troublemaker when we point out procedures that are not followed, common security practices that are considered too complicated, good reflexes that have been abandoned due to lack of time. We confess our uncertainty about risk analysis or our pessimism if we survive without our advice being followed…
But we have all learned that to succeed, we need a positive spirit, openness to new technologies, autonomy, creativity, and above all an year for market changes. This is generally what CISOs do: they follow the latest recognized standards, try to convince, coach, implement artificial intelligence in network supervision…
But their role is also to find vulnerabilities, to set social engineering traps, to insist on good documentation avoid future errors and loss of know-how, to require traceability of decisions and acceptance of risks (without embellishment), thus ensuring sustainable decisions, instead of justifying preconceived ones. The CISO is thus the right ally for a CEO who is looking for the best decisions in the face of new challenges.
It is by disagreeing with an observed security that the CISO stimulates to find better. And his persistence avoids risks: services started without an adequate agreement on responsibility, too fast migration to the cloud creating dependency for a short-term advantage, open doors to cybercrime, resignation in the face of internal negligence. It avoids downtime or costly replacements or fixes.
Fortunately, it is not only CISOs who are holding back. A courageous CEO recently confessed to me that he often finds himself in the position of putting the brakes on projects in which the customer’s view, financial feasibility, security, legal compliance, etc. have been neglected. Enthusiasm does not guarantee success.
For sustainable projects, managers cannot escape from working with CISOs and taking care of security and data protection themselves. And there are often CISOs who come up with interdisciplinary and creative solutions, sometimes simpler than expected and standing in contrast to the flagship products that do everything but work efficiently without qualified personnel.
Let’s not forget that many great ideas and successes have been created by offensive people like Steve Jobs or meticulous people like Bill Gates… Without sweat and rivalry, customers won’t get the secure services they deserve.
Carlo Harpes
itrust consulting