Feeds

Wannabe infosec kingpins: Forget tech, grab a clipboard

Ditch the debugger, bone up on biz risk management

Choosing a cloud hosting partner with confidence

Budding chief information security officers (CISOs) would be better off boning up on business, communication, and risk management skills than getting bogged down in detailed discussions about technology, according to a panel of senior security professionals.

The overwhelming message from the InfoSecurity Summit 2012 in Hong Kong, was that CISOs need to be trusted and they need to add value, but most importantly they must understand risk in all areas of the business and then manage that risk proactively.

“The days of the CISO being technology-focused are over; the role is much more transversal now,” argued Jerome Walter, chief security officer Asia Pacific at French bank Natixis. “You should build relationships. Each department has different risk, different issues and you need to create an image of trust so they’ll come to you.”

Thomas Parenty, MD of fraud prevention firm Parenty Consulting, agreed, adding that security should never be approached out of context of the business.

“You need to deeply understand what the business does to be effective,” he said. “You need to better understand how the business operates more than you need to know about the security technology – that can be handled by someone else.”

This is not to say that CISOs should have no competence in technology, however, according to Dale Johnstone, who heads up security and risk management at the Hong Kong Hospital Authority.

“The fundamental principles of security have stayed the same over the years and a good CISO has to have enough understanding of technology to communicate with the tecchie people and the higher level management,” he explained.

“However, today they’re very reactive: fire-fighting and waiting for problems to happen rather than putting together an overall strategic plan.”

Trying to protect all the organisation’s information all the time can be challenging, especially when the bad guys can put all their resources into nabbing just one bit of it.

Thus, being able to discern “the pythons from the cockroaches” – or those attacks which could seriously damage a firm and those which aren’t so dangerous – is also a key skill, according to Vikalp Shrivastava, info security boss at casino group Melco Crown Entertainment.

There was one final piece of important advice for budding CISOs from Steve Tunstall, head of corporate risk at Cathay Pacific Airways: beware the regulators.

“What scares me is that data moves so fast. For many years our data was in mainframes, but over the past few years that shoe box has not only become porous, now it’s disappeared,” he argued.

“I don’t know where half the stuff is now. Regulators are slow to catch on but when they do the penalties are getting worse and worse. If you’re not alive to the latest changes in penalties you will be when a writ arrives on your desk.” ®

Intelligent flash storage arrays

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Special pleading against mass surveillance won't help anyone
Protecting journalists alone won't protect their sources
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Apple's iPhone 6 first-day sales are MEANINGLESS, mutters analyst
Big weekend queues only represent fruity firm's supply
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Bill Gates, drugs and the internet: Top 10 Larry Ellison quotes
'I certainly never expected to become rich ... this is surreal'
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
EMC, HP blockbuster 'merger' shocker comes a cropper
Stand down, FTC... you can put your feet up for a bit
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.