Be a More Effective CISO by Aligning Security to the Business

The recently released F5 and Ponemon report, "The Evolving Role of CISOs and their Importance to the Business," unearthed some disconcerting results about CISO effectiveness. In particular, the survey asked specifically: Are security operations aligned with business objectives? The answer:

If security isn’t aligned with the business objectives of the organization, then how can the security program function effectively? Security always exists in context to something else, and that context is the organization’s business objectives. If you’re one of those 40% not aligning at all with your business goals, here are X things you can do.

Step 1: Understand the Business
To build a security program that matches business objectives, you first have to understand the business. How do you do this? By asking questions and doing your homework, and not just about your organization but about your industry sector, as well.

Step 2: Leverage the Business Understanding
Use this information to get buy-in on risk reduction programs. Remember that when a security incident occurs, it can have many different kinds of impacts: loss of customer confidence, reduction in sales advantage, regulator fines, operational overhead, and loss of competitive advantage due to breached trade secrets. Find the hot buttons and push them.

Step 3: Break Down Barriers
The F5 Ponemon survey also touched on how much silo and turf issues can impede a security program’s effectiveness with the question: Do turf and silo issues diminish security strategy? The response:

To help break through the silos, you need to work with each group towards the common company goal of protecting the business of the business. This means you will need to explain your message in terms of each department’s critical processes and requirements. By tying back to the common goal of furthering the organization’s strategic goals, you can help get everyone moving in the same direction and build cooperation.

Step 4: Empathetic Listening
A key to building cooperation is to develop the skill of empathetic listening to engage your ears before you start hammering a message into people. You listen with the goal of understanding the other person’s point of view and acknowledging how they feel about the situation. Listen to people’s complaints. Users work in different contexts than IT and security. They have work that needs to get done that has nothing to do with your security policy. Listen carefully to their problems and then, once they’ve had their say, you can connect their jobs to the security mission.

Step 5: Leverage Contextual Business Knowledge
To break down barriers and silos, you’ll need to align users’ daily practices with security. Hopefully your examination of organizational processes and goals provides the information you needed for this. It also is useful for framing your security messages in the language of the organization’s culture, not in terms of security culture. This leads to a key part of making this work: giving people understandable reasons why a security process is in place.

Step 5: Talk about Threats and Impacts
Using the institutional knowledge, you’ve gathered, explain why you’re implementing particular security processes. Be specific and detailed about what you’re trying to prevent, and clarify how the process will control it. This will also help get people on your side when a process doesn’t work perfectly. For example, if you explain that customer social security numbers should always be encrypted, then users can let you know when they see them displayed in plain view. In this way you can quickly zero in on security incidents and fix problems.

Another big motivator is explaining how security incidents directly affect the organization’s ability to function and meet its business objective by measuring risk in terms of the loss of operational efficiency and business capability. This is a powerful technique, especially if you’ve got a strong grasp on what the organization cares about.

Get the latest application threat intelligence from F5 Labs.