We Make Threat Actors Read Our Resiliency Policy Before Attacking Us

Many businesses realize that cyberattacks are inevitable. A sound business policy, led by the security department, is one of resiliency. Business continuity planning and disaster recovery are understood goals, but getting started and getting all parties coordinated is where the difficulty lies. Where should a resiliency plan begin to deliver the most immediate impact?

This week’s episode is hosted by me, David Spark , producer of CISO Series and Andy Ellis , operating partner, YL Ventures . Joining us is Patricia Titus , CISO, Booking Holdings (NASDAQ: BKNG) . 

Defense vs. Resilience

Let’s not conflate defense with resilience. Defense focuses on preventing bad days, while resilience is about coping with them. The key to resilience lies in robust incident response (IR) planning, which includes continuous testing and updating of IR plans to ensure muscle memory across all levels of the organization, argued Philippe Cornette , group CISO of John Cockerill . It is crucial to involve the entire team in these exercises. Increasingly that means using AI-driven gamification tools for continuous improvement. And during an incident, everyone needs a clear understanding of their roles. This approach not only drives for immediate response but also supports post-incident recovery, preventing recurrent issues and fostering a resilient cybersecurity posture.

Communication is on par with mitigation

During a security crisis, we judge success by the effectiveness of communication rather than the mitigation of the security issue, said former Uber CISO Joe Sullivan . Clear, frequent, and consistent messaging is crucial, as it shapes public perception and maintains stakeholder confidence. Involving the CISO in crafting and approving all communications ensures technical accuracy and alignment with previously stated company positions. Collaborating with communications and legal teams from the outset of an incident, and practicing these scenarios through tabletop exercises, builds a cohesive response strategy. Integrating security incident response with broader technical response practices also enhances preparedness and resilience.

Preparing like its post-quantum

With recent advancements in quantum computing error correction, CISOs need to proactively prepare their organizations for a post-quantum future, noted Frederic Lardinois on TechCrunch . This involves assessing and updating digital certificates, encryption methods, and vendor strategies to ensure compatibility with future encryption standards. A reactive approach will be too late. Instead, prioritize developing a quantum-resilient strategy that includes the capability to update encryption algorithms as needed. As quantum computing adds uncertainty around current encryption methods, maintaining a focus on resilience is vital. Prepare for the reality of post-quantum encryption now as the tools become available. 

The challenges and opportunities of diversity

According to a 2023 ISC2 study, most professionals see an inclusive environment as essential for team success, noted Aimee Chanthadavong for CSO Online . Leaders must recognize and address gaps in their hiring practices. Want diverse candidate pools? Work closely with HR and to source talent across geographies. Diversity hiring is only the start. Leaders must create an inclusive culture where diverse voices are heard and valued. Inclusion drives the true benefits of diversity: enhanced innovation, productivity, and resilience. Encourage open dialogue and challenge assumptions to foster a dynamic and effective cybersecurity team.

Listen to the full episode over on our blog or your favorite podcast app where you can read the entire transcript. If you haven’t subscribed to CISO Series Podcast via your favorite podcast app, please go ahead and do so now.

Thanks to Jonathan Waldrop , CISO, The Weather Company for providing our “What’s Worse” scenario. Thanks to Cyera .

Huge thanks to our sponsor, Cyera

Subscribe to CISO Series Podcast

Please subscribe via Apple Podcasts, Spotify, YouTube Music, Amazon Music, Pocket Casts, RSS, or just type "CISO Series Podcast" into your favorite podcast app.

What Is a Field CISO?

"I think field CISO is getting abused now. I think you can hire people who have no CISO experience as field CISOs, which I think like anything CISO-esque, it's just being used for security marketing. I guess I'd be careful just in how we start to approach this or continue to use it." - William Harmer, CISSP, CISM, CIPP , operating partner and CISO, Craft Ventures .

Listen to full episode of "What Is a Field CISO?"

Subscribe to our newsletters on LinkedIn!

We've got our bi-weekly and daily Cyber Security Headlines newsletters available right here on LinkedIn. Go ahead and subscribe to one or both!

CISO Series Newsletter - Twice every week

Cyber Security Headlines Newsletter - Every weekday

Cyber Security Headlines - Week in Review

Make sure you register on YouTube to join the LIVE "Week In Review" this Friday for Cyber Security Headlines with CISO Series reporter Richard Stroffolino . We do it this and every Friday at 3:30 PM ET/12:30 PM PT for a short 20-minute discussion of the week's cyber news. Our guest will be DJ Schleen , distinguished security architect, Yahoo . Thanks Vanta .

Thanks to our Cyber Security Headlines sponsor, Vanta

Join us Friday [08-16-24], for "Hacking the Demo"

Join us Friday, August 16, 2024, for Super Cyber Friday's “Hacking the Demo: An hour of critical thinking about how to be pitch perfect.”

It all begins at 1 PM ET/10 AM PT on Friday, August 16, 2024 with guests Howard Holton , CTO and industry analyst, GigaOm and Tom Hollingsworth , organizer and networking analyst, Tech Field Day . We'll have fun conversation and games, plus at the end of the hour (2 PM ET/11 AM PT) we'll do our meetup.

Register

Thank you! Thank you for supporting CISO Series and all our programming

We love all kinds of support: listening, watching, contributions, What's Worse?! scenarios, telling your friends, sharing in social media, and most of all we love our sponsors!

Everything is available at cisoseries.com.

Interested in sponsorship, contact me, David Spark.