www.helpnetsecurity.com Open in urlscan Pro
54.203.13.2  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1691028934"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

searchtwitterarrow rightmail strokearrow leftmail solidfacebooklinkedinplusangle
upmagazine plus
 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Mirko Zorz, Director of Content, Help Net Security
August 2, 2023
Share


FROM TECH EXPERTISE TO LEADERSHIP: UNPACKING THE ROLE OF A CISO



In this Help Net Security interview, Attila Török, CISO at GoTo, discusses how
to balance technical expertise and leadership and how he navigates the rapidly
evolving technological landscape.

We also delve into the key challenges faced in communicating complex security
issues to stakeholders and maintaining trust amidst declining trust in
institutions.



IN YOUR OPINION, WHAT ARE THE KEY CHARACTERISTICS OF AN EFFECTIVE CISO? HOW DO
YOU BALANCE TECHNICAL EXPERTISE AND LEADERSHIP SKILLS?

A CISO needs to wear many hats across the business and juggle many competing
priorities. They need to be a customer support representative, a product
partner, a manager, a visionary, a strategist, and of course, a security expert.

I have found that some of the most important characteristics are to be friendly,
honest, and emphatic. Being a friend to the organization and people you work
with, rather than leading with just policies and demands, is critical to getting
more done and the success of your team.

It may sound counterintuitive, but a good CISO must get out from behind the
technology and understand the people they are serving. Of course, you must
maintain a high level of technology knowledge, but if you find yourself only
sitting in front of a firewall console, you’re probably in the wrong job.

GIVEN THE RAPID RATE OF TECHNOLOGICAL CHANGE, HOW SHOULD CISOS APPROACH BUILDING
AN ORGANIZATION’S SECURITY POSTURE?

With the more-rapidly-than-ever changing environment, you can rarely rely solely
on multi-year strategies or multi-quarter roadmaps. You must be ready for
constant change and quickly adapt to it.

CISOs must create a security strategy built around anticipating outcomes and a
feedback loop to gather information during incidents, assessments, threat
analysis, and research. The information gathered should then be turned into
metrics which will give insights into if the strategy is working, and, if
necessary, how to evolve the strategy.

IN TODAY’S BUSINESS ENVIRONMENT, A CISO MUST COMMUNICATE COMPLEX SECURITY
ISSUES. HOW CAN YOU ENSURE YOU’RE UNDERSTOOD BY ALL STAKEHOLDERS, INCLUDING
THOSE WHO AREN’T AS TECH-SAVVY

Though CISOs play a lead role in managing an organization’s security posture, it
is important that cybersecurity efforts manifest as a shared responsibility
across an organization. From new hires to the C-suite, cybersecurity should be a
communicated priority for all employees. Everyone should care about security,
and if they don’t do it, it’s because they don’t understand something about the
situation or ask.

Just as much as a CISO needs to learn about the business, they must also educate
other business leaders on what’s out there and the landscape of evolving
threats. Then, it’s important to connect these threats and the solutions back to
the goals of that part of the business so teams can fully understand the role
they can play in mitigating risk.

WITH DECLINING TRUST IN INSTITUTIONS, HOW CAN CISOS HELP ORGANIZATIONS BUILD AND
MAINTAIN TRUST AMONG CUSTOMERS, EMPLOYEES, AND STAKEHOLDERS?

It’s important to prioritize security and proactively communicate initiatives
with stakeholders. However, building and maintaining trust isn’t a
one-size-fits-all approach. CISOs must possess the ability to effectively
communicate and educate all stakeholders about the specific cyber risks relevant
to their organization while also proactively outlining how it is prepared to
address those risks. Implementing robust, proactive security measures and
emphasizing the protection of sensitive data will reassure customers,
stakeholders, and employees alike that their information is secure. Swiftly
acting on emerging and existing security threats also reinforces trust and
demonstrates an organization’s proactive efforts in addressing threats before
they become detrimental.

THE ROLE OF A CISO ENCOMPASSES A WIDE RANGE OF RESPONSIBILITIES, INCLUDING
COMPLIANCE, DISASTER RECOVERY, AND STAKEHOLDER MANAGEMENT. HOW CAN A CISO
EFFECTIVELY MANAGE SUCH A DIVERSE PORTFOLIO OF TASKS?

There are three ways I manage competing priorities: Focus, transparency, and
accountability. A CISO must focus on the tasks that have the biggest ROIs, and
not get distracted by the noise. Leading with transparency will make it clear to
everyone within the organization why we are making changes or asks. And finally,
security posture and response can only be improved when accountability is clear.
And not just accountability of the security team, but accountability from across
the organization where everyone understands the responsibility.

By making data-driven decisions and conducting continuous risk assessments,
CISOs can strategically allocate resources to high-priority tasks. The delicate
balance lies in leading these various aspects while leveraging the expertise of
a skilled team to ensure comprehensive security protection across the
organization. By staffing a knowledgeable team of security experts and
empowering them to take ownership of their day-to-day responsibilities, CISOs
can focus their time on providing strategic and executive-level oversight on key
issues.

GIVEN THE CONSTANTLY EVOLVING THREAT LANDSCAPE, HOW CAN A CISO MAINTAIN ITS
TECHNOLOGICAL EXPERTISE WHILE FOCUSING ON LEADERSHIP AND COLLABORATION?

From a leadership standpoint, the CISO is so much more than just security. It’s
truly a business leader position, they are collaborating with the other business
leaders to share the same resources. CISOs must understand the organizational
goals, the customer needs, and the capacity of each team to prioritize security
in collaboration with product management, IT leaders, CTO, etc.

CISOs must maintain fundamental technology knowledge but rely on the team’s
subject matter expertise for deeper technical aspects. It’s important to find
the right training, like CISSP, and vendor-specific certifications, without
overwhelming yourself.




More about
 * CISO
 * cybersecurity
 * data
 * data protection
 * GoTo
 * how-to
 * opinion
 * strategy
 * tips

Share this

FEATURED NEWS

 * Attackers can turn AWS SSM agents into remote access trojans
 * Delivering privacy in a world of pervasive digital surveillance: Tor
   Project’s Executive Director speaks out
 * From tech expertise to leadership: Unpacking the role of a CISO

Guide: Attack Surface Management (ASM)


SPONSORED


EBOOK: 9 WAYS TO SECURE YOUR CLOUD APP DEV PIPELINE


FREE ENTRY-LEVEL CYBERSECURITY TRAINING AND CERTIFICATION EXAM


GUIDE: ATTACK SURFACE MANAGEMENT (ASM)




DON'T MISS


ATTACKERS CAN TURN AWS SSM AGENTS INTO REMOTE ACCESS TROJANS


DELIVERING PRIVACY IN A WORLD OF PERVASIVE DIGITAL SURVEILLANCE: TOR PROJECT’S
EXECUTIVE DIRECTOR SPEAKS OUT


FROM TECH EXPERTISE TO LEADERSHIP: UNPACKING THE ROLE OF A CISO


OPEN-SOURCE PENETRATION TESTING TOOL BLOODHOUND CE RELEASED


ANDROID N-DAY BUGS POSE ZERO-DAY THREAT




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2023 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×