Speaker 1: Welcome back to the deep dive. Today. We're opening the
Speaker 1: playbook for successful information security leadership, right, but we're deliberately
Speaker 1: keeping the technical stack, you know, in the closet for
Speaker 1: this one.
Speaker 2: Huh yeah, good place for it.
Speaker 1: Sometimes our deep dive is into the art of infosec,
Speaker 1: that subtle, non technical side of building a really robust
Speaker 1: and importantly sustainable security program.
Speaker 2: That's absolutely our focus. Our mission really is to synthesize
Speaker 2: the insights from the source material and extract what looks
Speaker 2: like the true formula for creating respected security function. And
Speaker 2: whether you're starting with a blank sheet of paper or
Speaker 2: inheriting a bit of a chaotic mess, the argument here
Speaker 2: is pretty compelling, which is which is a long term
Speaker 2: success changes far more on people skills, cultural influence, and
Speaker 2: you know, management finesse than on any particular piece of
Speaker 2: security software.
Speaker 1: And the context for needing this shift it's actually quite shocking,
Speaker 1: isn't it. The author shares his experience moving from a
Speaker 1: military environment.
Speaker 2: Right where security is just baked.
Speaker 1: In exactly it's understood, and followed moving from that to
Speaker 1: the corporate infosec world back in January two thousand. He
Speaker 1: calls that transition an absolute shock.
Speaker 2: Yeah. I remember reading that part.
Speaker 1: Stating he had more sleepless nights in his first year
Speaker 1: of corporate life than navigating the Persian Gulf during armed conflict.
Speaker 2: Wow. That really tells you something, doesn't it.
Speaker 1: It tells you everything about the apathy he must have
Speaker 1: faced immediately.
Speaker 2: Exactly, and that initial shock it sort of defines the
Speaker 2: environment for so many.
Speaker 1: That feeling of pushing a boulder uphill.
Speaker 2: Yeah, most security leaders feel like that because the fundamental
Speaker 2: forces of the organization often seem to be working against them.
Speaker 2: That feeling of being perpetually outmatched. That's the difficult reality
Speaker 2: you pretty much have to accept, Okay, because it frames
Speaker 2: every strategic decision you're going to make going forward.
Speaker 1: Okay, let's unpack this difficult reality. Then what are the uh,
Speaker 1: the undeniable fundamental facts describing the environment for most INFOSEC professionals.
Speaker 2: Well, the source material lays out three pretty brutal truths.
Speaker 2: And again this is for the majority. Right, we're excluding
Speaker 2: the rare unicorns in say, highly regulated sectors like banking
Speaker 2: or maybe those with really strong executive sponsorship.
Speaker 1: Got it, So for most places.
Speaker 2: For most places, first, nobody in the company outside of
Speaker 2: your own team usually cares that much about infosec houch.
Speaker 1: Okay.
Speaker 2: Second, nobody in the company really understands your job. I
Speaker 2: mean the scope is just massive, right, covering eight separate domains,
Speaker 2: demanding you interact with engineering, HR, legal product teams all
Speaker 2: at the same time. And Third, our entire industry, let's
Speaker 2: be honest, is often guided by fear and scare.
Speaker 1: Tactics, which doesn't always work.
Speaker 2: Which often backfires. Yeah.
Speaker 1: I think that first point the apathy one. We need
Speaker 1: to stop there for a second. The sources mentioned this
Speaker 1: like shocking cultural disconnect. If we all agree. Number one,
Speaker 1: security control is asset enumeration.
Speaker 2: Knowing what you have?
Speaker 1: Yeah, knowing what you have? Why is neglecting that proof
Speaker 1: of apathy?
Speaker 2: Well, it's proof because asset enumeration is just a fancy
Speaker 2: way of asking what digital stuff do we own and
Speaker 2: where is it? Right? Simple question seems simple, But if
Speaker 2: you don't know what digital assets you have, you just
Speaker 2: you can't protect them. It's like building a fortress without
Speaker 2: knowing how many doors and windows it has.
Speaker 1: Right.
Speaker 2: The fact that so many organizations seem to completely ignore
Speaker 2: this foundational step, it just shows that security often isn't
Speaker 2: the priority it's treated more like an afterthought.
Speaker 1: Wait, but if this lack of care is so pervasive,
Speaker 1: you mentioned policy violations being ignored while HR policies get
Speaker 1: strictly enforced. Isn't that a failure higher up like executive leadership?
Speaker 1: How can one CISO possibly overcome that kind of ingrained
Speaker 1: disregard without you know, massive regulatory backup.
Speaker 2: You've hit the absolute central dilemma. And the conclusion from
Speaker 2: this this painful reality check is pretty stark, which is
Speaker 2: the work of building a sustainable INFOS program rests essentially
Speaker 2: solely on the security leader's shoulders. Wow, you have to
Speaker 2: accept that you are effectively on your own. You can't
Speaker 2: just rely on executive mandates or fear tactics to compel change.
Speaker 2: That acceptance it sounds negative, but it's actually the necessary
Speaker 2: first step toward building the program strategically.
Speaker 1: That makes a lot of sense. Actually. Okay, So once
Speaker 1: you accept that environment, the source material pivots pretty quickly
Speaker 1: to the art of the job. It presents a seven
Speaker 1: step formula. Let's dive into the first two because they
Speaker 1: seem purely cultural.
Speaker 2: They really are. Step one is the absolute foundation of
Speaker 2: this whole approach. Relationships come first, always. Success is basically
Speaker 2: impossible without building truly excellent working relationships across the entire company.
Speaker 2: And to do this, the infosec team has to dedicate
Speaker 2: get this up to twenty five percent of its entire
Speaker 2: operational time just to activities that build and maintain these bridges.
Speaker 1: Twenty five percent. That's yeah, that's huge. What does that
Speaker 1: actually look like? Is that just like smiling at people
Speaker 1: in the hallway.
Speaker 2: Yeah? No, far from it. It means actively looking for
Speaker 2: ways to help other teams solve their problems, even if
Speaker 2: they aren't strictly security problems initially.
Speaker 1: Ah, okay, building goodwill exactly.
Speaker 2: It means running informal sessions, maybe not about rules, but
Speaker 2: about understanding, say a pure department's new product launch constraints.
Speaker 2: It means, you know, taking system owners out for vendor
Speaker 2: sponsored lunches, just removing that transactional friction. Right. The contrast
Speaker 2: here is that classic, often contentious approach where the security
Speaker 2: team acts like a radiologist a radiology, Yeah, just holding
Speaker 2: up the X ray showing all the flaws, you know,
Speaker 2: exposing shortcomings. System owners then start referring to your vulnerability
Speaker 2: scanning as friendly fire.
Speaker 1: Ouch, yeah, I've heard that.
Speaker 2: And that just breeds organizational antibodies, right, people actively trying
Speaker 2: to block the security team. Yeah, and that that's the
Speaker 2: kiss of death for any COSO.
Speaker 1: So we shift from being the company police to being
Speaker 1: like trusted consultants precisely. Okay, that transition leads us right
Speaker 1: into step two. Alignment. Now, this seems really counterintuitive compared
Speaker 1: to the traditional security purist approach that says you must
Speaker 1: strive for maximum protection no matter the cost.
Speaker 2: It is counterintuitive, but critical.
Speaker 1: Yeah.
Speaker 2: Alignment means recognizing that your job is to be the
Speaker 2: security person the company wants you to be, not the
Speaker 2: purest you think they should have. It means operating within
Speaker 2: the company's existing and often unstated risk tolerance. You absolutely
Speaker 2: have to read the culture and figure out where the
Speaker 2: company's risk needle is actually pointed when it comes to
Speaker 2: information loss.
Speaker 1: Okay, how do you read that needle. It's not like
Speaker 1: they publish it.
Speaker 2: Right now, definitely not. The best indicator usually is how
Speaker 2: the organization reacts or doesn't react to a major incident
Speaker 2: or a breach. Ah.
Speaker 1: Actions speak louder than words.
Speaker 2: Toti. The author shares this career defining moment He experienced
Speaker 2: a breach that got in his words, hardly any attention
Speaker 2: really a breach. Yeah, leadership didn't demand some big executive summary,
Speaker 2: No new resources flowed, nobody got reprimanded, and he realized
Speaker 2: quite clearly the company didn't really care about data breaches.
Speaker 1: That must have been jarring.
Speaker 2: Jarring, but also clarifying this revelation was key. It allowed
Speaker 2: him to stop stressing over those purest ideals, align with
Speaker 2: the actual appetite for risk, and then focus on building
Speaker 2: the program the company would genuinely support and fund. Wow.
Speaker 2: Failure to align with that reality, that's often why CSOs
Speaker 2: find themselves constantly in conflict and probably why the average
Speaker 2: tenures just a little over two years. They're fighting the
Speaker 2: culture instead of working within it.
Speaker 1: That is, that's the ultimate strategic point, isn't it? Okay,
Speaker 1: Moving past acceptance and alignment, let's talk practical tools. How
Speaker 1: do you build the program when you know your central
Speaker 1: team will always be basically resource constrained?
Speaker 2: Right, you use governance and shared ownership. This starts with
Speaker 2: what the source calls the four cornerstones as part of three,
Speaker 2: and then it moves into the necessity of the neighborhood watch,
Speaker 2: which is step five.
Speaker 1: Okay, cornerstones First, what are they?
Speaker 2: There are foundational governance documents. First, you absolutely need an
Speaker 2: information security charter. Think of this as your political document.
Speaker 2: It grants authority, but crucially it codifies shared infosec responsibility
Speaker 2: across departments.
Speaker 1: So it's not just securities problem exactly.
Speaker 2: Then you need the information security policy, but it has
Speaker 2: to align with reality. Often that means keeping it brief, clear, focused,
Speaker 2: not just some industry standard sprawl that nobody reads.
Speaker 1: Practical okay.
Speaker 2: And finally, the Security Incident Response Plan SRRP. Got to
Speaker 2: have that.
Speaker 1: Okay, makes sense. And to make those documents actually work
Speaker 1: and ensure those relationships you build earlier actually influenced decisions,
Speaker 1: you need the governance councils right.
Speaker 2: Exactly right. You need structure. The source recommends three distinct
Speaker 2: councils to manage decision making and ensure alignment up and
Speaker 2: down the hierarchy.
Speaker 1: Okay, what are they.
Speaker 2: First, At the technical level, you have the Extra Ended
Speaker 2: Security Council xSe. This brings together the technical leads, you know,
Speaker 2: the people who actually do the work to discuss complex
Speaker 2: technical stuff, the tasty topics as the author calls them.
Speaker 2: This council informs the strategy.
Speaker 1: So the geeks get to talk geek.
Speaker 2: Pretty much yea, and their input is vital. Then that strategy,
Speaker 2: those ideas move up to the Security Business Council SBC.
Speaker 2: This group includes key business representatives. They review the xsse's input.
Speaker 2: They help run the infosec strategy. They weigh in on
Speaker 2: things like new purchases or policy changes. This is where
Speaker 2: the real buy in and alignment happen at the business level.
Speaker 2: Can you give an example, sure, Let's say you want
Speaker 2: to increase the frequency or maybe the consequences of phishing campaigns.
Speaker 2: Instead of just decreeing it, you let the SBC debate it.
Speaker 2: They discuss the impact the frequency. Since they effectively own
Speaker 2: the decision.
Speaker 1: They own the outcomes and the pushback exactly.
Speaker 2: It takes the heat off the central infosec team. And
Speaker 2: then finally, for budget approval and final sign off, you
Speaker 2: have the Executive Security Council yes SE, which is your
Speaker 2: senior leadership group. The whole structure is designed to share
Speaker 2: the burden.
Speaker 1: Share the burden of decision making.
Speaker 2: That's the whole point. The central infosec team simply cannot
Speaker 2: own all the operational risk. The company has to, and
Speaker 2: that thinking leads us directly to step five, give your
Speaker 2: job away.
Speaker 1: Give your job away.
Speaker 2: Sounds crazy, right, but it's the neighborhood watch concept.
Speaker 1: Okay, explain this one. This sounds revolutionary, maybe a bit
Speaker 1: scary for a security team. Why is giving away your
Speaker 1: job necessary?
Speaker 2: It's necessary because infosec is just too broad, too massive
Speaker 2: for one single department to control everything. You can't possibly
Speaker 2: secure all the assets centrally. Just not enough people, never
Speaker 2: enough people. So the only real hope for actually securing
Speaker 2: the environment is to transition security responsibilities, things like managing
Speaker 2: endpoint security or administering firewalls. Transition those tasks to the
Speaker 2: system owners and the engineering teams that already manage those
Speaker 2: assets day to day.
Speaker 1: Ah. So the people who own the system own at
Speaker 1: security too.
Speaker 2: That's the goal. The central infosec team has to shift
Speaker 2: its role almost entirely, become governance, consulting policy guidance. Effectively,
Speaker 2: you deputize others across the organization to protect their own homes.
Speaker 2: You run the neighborhood watch program.
Speaker 1: Okay, but if we're relying on the neighborhood watch to
Speaker 1: protect the homes, those neighbors need to know what they're doing, right.
Speaker 1: They need to be competent.
Speaker 2: Absolutely critical point.
Speaker 1: Which brings us to step four communications education and awareness.
Speaker 1: How do we ensure that this kind of cultural training
Speaker 1: actually sticks and produces measurable results, not just check the
Speaker 1: box stuff.
Speaker 2: Yeah, awareness cannot be an afterthought or just boring compliance videos.
Speaker 2: It's a critical cornerstone and honestly, it probably requires a
Speaker 2: dedicated creative staff member. If you want to do it well.
Speaker 1: What does doing it well look like?
Speaker 2: Variety? You need different channels, lunch and learns, engaging newsletters,
Speaker 2: maybe with humor, raffles, campus events, anything to make it
Speaker 2: not feel like a choice. But the real ROI, interestingly
Speaker 2: often comes from targeted technical education for your peers in
Speaker 2: IT and engineering.
Speaker 1: Ah okay, the source material gives a great example of this,
Speaker 1: doesn't it. Where the security team was just stonewalled for
Speaker 1: like a year trying to get intrusion detection systems IDs installed.
Speaker 2: That's the perfect example. The bureaucratic channels, the formal requests,
Speaker 2: they failed for over a year, nothing happened.
Speaker 1: So what did the security leader do escalate?
Speaker 2: Nope, instead of escalating and creating more friction, he built
Speaker 2: the relationship and offered value. He arranged for an external
Speaker 2: vendor to provide specialized network security training, good training specifically
Speaker 2: for the network services.
Speaker 1: Team, ah, giving them something useful exactly.
Speaker 2: The engineers attended, they were empowered by the knowledge they
Speaker 2: learned why it mattered from experts, and within two weeks
Speaker 2: two weeks of the course finishing, they rushed to install
Speaker 2: the IDs systems themselves at all the key Internet points
Speaker 2: of presence.
Speaker 1: Wow, just from the training.
Speaker 2: The requirements were delivered through a valuable training session by
Speaker 2: respected industry folks, not by the central security team just
Speaker 2: demanding compliance. Huge difference.
Speaker 1: That really shows that relationship building and smart awareness provide
Speaker 1: security gains, maybe far beyond what tech alan could achieve,
Speaker 1: and probably way cheaper.
Speaker 2: Too often at a fraction of the cost.
Speaker 1: Yes, okay, let's move quickly to step six team building.
Speaker 1: If your team members are going to be these evangelists,
Speaker 1: these deputies, what's the non negotiable hiring criterion?
Speaker 2: Technical candidates absolutely must have great interpersonal skills, full stop.
Speaker 2: More important than sertch in this model, Yes, more valuable
Speaker 2: than any specific certification. Remember, you're sending these people out
Speaker 2: as ambassadors to build that neighborhood watch. If they lack
Speaker 2: the grace the empathy, the political agility to handle sticky situations.
Speaker 1: They'll create those antibodies you mentioned.
Speaker 2: Exactly, they'll generate resistance against the team, and all your
Speaker 2: carefully constructed governance efforts could fail. You hire for diflomacy
Speaker 2: and communication skills first. Then technical aptitude makes sense, okay.
Speaker 1: Finally, step seven measure what matters if the ultimate goal
Speaker 1: is this self defending organization. What are the key metrics?
Speaker 1: How do you show that cultural change is actually happening.
Speaker 2: You need to focus on metrics that are simple, resonate
Speaker 2: with leadership, and actually prove the culture is shifting. The
Speaker 2: author really focuses on two main ones, which are metric one.
Speaker 2: Can staff recognize a policy violation when they see one
Speaker 2: and do they report it? That shows awareness of the rules?
Speaker 1: Okay?
Speaker 2: And the second metric two, which he calls the mother
Speaker 2: of all metrics. Can staff identify a phishing email and
Speaker 2: report it?
Speaker 1: Ah the phish test.
Speaker 2: It measures the level of healthy skepticism and vigilance in
Speaker 2: the general employee base. It's a direct indicator of awareness, effectiveness.
Speaker 1: And the results from these kinds of intensive cultural campaigns
Speaker 1: they prove the power of this focus.
Speaker 2: They really do the source sites an initial social engineering
Speaker 2: assessment where the failure rate was forty six percent. Almost
Speaker 2: half the employees gave up critical credentials over the phone
Speaker 2: to someone just posing his IT support.
Speaker 1: Forty six percent.
Speaker 2: That's bad, that's really bad. But after a three year
Speaker 2: intensive creative awareness campaign BLITZ using all those techniques we
Speaker 2: talked about, that failure rate dropped dramatically down to four percent.
Speaker 1: Wow, from forty six to four that's incredible.
Speaker 2: It's incredible, And that results is the ultimate proof, isn't it? Leadership,
Speaker 2: cultural change, smart awareness, they provide a staggering security ROI
Speaker 2: compared to just throwing money at more expensive boxes.
Speaker 1: So, to wrap it all up, the core idea here
Speaker 1: is successful INFOSEC isn't achieved by technological mandate from on high.
Speaker 1: It's achieved by leading a cultural change.
Speaker 2: Yeah, becoming the company's trusted.
Speaker 1: Advisor, and building this wide network of advocates the neighborhood watch.
Speaker 2: Precisely, if you, as a security leader, want to ensure
Speaker 2: your survival and hopefully thrive beyond that depressingly short average
Speaker 2: CIO tenure, you need to ruthlessly prioritize maybe three things.
Speaker 1: What are they?
Speaker 2: First? Culture? Those relationships. They literally determine the quality of
Speaker 2: the security program you are allowed.
Speaker 1: To build, allowed to build interesting freezing.
Speaker 2: Second, insure alignment, operate within the company's actual stated or
Speaker 2: demonstrated risk tolerance, even if it feels uncomfortable sometimes compared
Speaker 2: to best practices. And third, view your work as incremental progress.
Speaker 2: Think of it as continuous laps around the track. Always
Speaker 2: always prioritize kindness, humidity, and adding value over picking fights,
Speaker 2: even with difficult teams or underperforming neighbors.
Speaker 1: The source material suggests, and I like this framing that
Speaker 1: while infosic leadership needs those left brain muscles analysis engineering,
Speaker 1: the art side absolutely demands right brain.
Speaker 2: Thought, creativity, empathy, diplomacy.
Speaker 1: Yeah, to really win over your colleagues. So here's a
Speaker 1: final thought for you listening. If you find yourself perpetually,
Speaker 1: you know, warring with other departments over security controls or requirements,
Speaker 1: consider this. What is just one way you could leverage
Speaker 1: a simple relationship building technique this week. Maybe volunteering your
Speaker 1: team's tech skills to solve a totally non security problem
Speaker 1: for an antagonistic department, or maybe running a short, informal
Speaker 1: but highly valuable training session on something they care about
Speaker 1: just one small step to turn a detractor into even
Speaker 1: a hesitant security advocate.
Speaker 2: That choice, that decision, that.
Speaker 1: Choice, that conscious effort to build a bridge instead of
Speaker 1: a wall. That's the true measure of the art of
Speaker 1: info sc