BLUF: The primary responsibility of a CISO is to ensure that an organization will maintain information security and integrity, ensure that it is not vulnerable, and implement safety measures to keep it secure. If I had the Job as CISO I would ensure my resources would be spent towards employee training, risk management, and applicable technology needed to keep the systems secure. I would primarily put my focus into training and risk management as I believe those to be the key to keeping a company system secure.
Resource management as a CISO
A CISO’s main job is to make sure an institution will keep the information and security intact, ensuring that it is not prone and put safety measures to keep it safe. If I were acting as a Chief Information Security Officer I would allocate my funds towards risk management, human resources/training, and making sure that we have the latest technology in cybersecurity (which is applicable to the company).
Firstly I would calculate the risks involved with both employee training and technology vulnerabilities. As in some of our readings, I recall seeing that the biggest risk in past cybercrimes is the human factor making employee training crucial. I would implement monthly training keeping the employees up to date on the latest software and things that they could be doing which is putting the company at risk. I would also make sure that every new employee would go through a cybersecurity training course where they would learn how to stay safe online and common mistakes when working in the industry. Keeping the employees well-trained and up-to-date would be a good way to allocate my resources towards. I would also use a portion of my resources to find risks within our system and overall vulnerabilities. Doing a risk evaluation would find the potential threat and key software vulnerabilities within the system. After completing this risk evaluation I would mitigate any risks which would show up by upgrading software, ensuring that the security measure is up to date, and investing whatever resources necessary. Using regularly scheduled risk management it can bring to light threats and how likely it is to happen.
Secondly, I would daily monitor the measures taken on the day to day basis managing all of the programs and whatever else. This includes both the digital and physical side of cybersecurity. According to csonline “42% of top security executives say they have had physical security duties added to their plate in the past three years”. Further proving that physical security is also crucial for keeping systems running and secure. Cybersecurity also obviously needs a digital security outline which is typically planning, buying, and implementing necessary software making sure the infrastructure is readily secure. Access management is also an aspect of security as ensuring only the right people can see certain things and have access to certain sensitive information ensures a chain of command as well as an extra layer of security. When facing a breach of security I should determine and investigate what went wrong and how to fix it making sure that it will not happen again in the future. Lastly, as a CISO you need to ensure that funding is readily available and you have the correct amount of resources to make sure that the system is both physically and digitally secure. Implementing security measures such as audits and security controls would further advance the cyber security within the system.