The Pragmatic CSO - 12 Steps to Being a Security Master

Hi, my name is Mike. This is my story. I'm a Chief Security Officer for a mid-sized company. I'm probably a lot like you. I used to spend my days with a fire extinguisher strapped to my back, trying to make sure the house wasn't burning down. I'd get emails and calls at all hours telling me about potential issues and things I need to add to my To-Do list. I'd grovel to get a new piece of equipment to stop the latest attack vector. Every 6 months the auditors would come in and tell me I'm an idiot. It wasn't very much fun. Sound familiar? Thankfully I met a few folks that put me in touch with a group that could help me. I learned there were a few root causes to many of my issues: * Security is viewed as a technical function - I was the "firewall" or "VPN" guy, not a member of the management team. Thus I had no credibility. I had spent a boatload of money and had very little to show for it. I had no plan. I couldn't describe success to the senior management of my company, so they wouldn't invest in helping me to protect their assets. * The bad guys are getting better - It used to be so easy. The bad guys would knock on the front door and I'd block them. Now, not so much. They use really sneaky attack and take advantage of my unsuspecting user community. They try to stay undetected and they steal my private data. * The auditors are tougher - With all of the frequent privacy breaches, the auditors are hypersensitive to pretty much everything. They would crawl into dark places in my environment and point out silly things, just to make me miserable.