How CISOs Can Succeed in Their First 100 Days

In today's environment of widespread data breaches and heightened cybersecurity threats, the role of a Chief Information Security Officer (CISO) or any executive responsible for cyber resilience is highly challenging. Research shows that the average tenure of a CISO is often 26 months, less than half of the tenure of other C-suite colleagues (4.9 years). Why is this the case?

According to the Heidrick & Struggles 2022 Global CISO Survey, 59% of CISOs globally stated that stress is the most significant personal risk associated with their role, while 48% cited job burnout and 21% felt underpaid. Added to this is the pressure of the role: 1 in 4 CISOs believe that their employment would be impacted if their organization fell victim to a breach.

The reality is that no company is immune to cyber attacks. In the first half of 2022, there were 2.8 billion malware attacks and 236.1 million ransomware attacks globally. By the end of 2022, 6 billion phishing attacks are expected to be launched.

The role of the CISO has become more strategic, moving beyond compliance and technical metrics monitoring to create and advocate a culture of shared cyber risk ownership. CISOs must develop a plan, balance stakeholders, and take a firm stance against cyber threats.

So what can a CISO do in their first 100 days on the job to lay the foundation for success?

While there is no one-size-fits-all approach to cyber or business strategy, the Cyber Leadership Institute offers a great framework that has been refined over time through hard-learned lessons in the trenches by industry veterans. Here, we will expand further on this to help new CISOs and cyber executives better understand the key activities that need to happen to maximize success.

▌Key Considerations

Beyond technical knowledge, successful cybersecurity leaders need to master two main skills. The first is understanding the business. In this sense, preparation is key. CISOs should learn as much as possible about the organization before day one. The company's annual report is a great starting point, but it also allows time to study who its customers are and the business lines that generate revenue. Most importantly, ensure you understand the key business objectives the organization is striving to achieve. A clear picture of where the company is heading and its prior performance will determine how much financial support is received.

It is wise to find out if the business has been in the news recently and if they have experienced any breaches.

The second set of skills to master includes strong communication and credibility. According to a Deloitte article, "Most must invest significant time to secure buy-in for safety initiatives. In other words, clearly communicating the impact of cyber risk on business outcomes has become a key factor in CISO success."

The tasks of the CISO role are daunting. However, without support from the top, it is difficult to succeed. Therefore, understanding the organization's goals and stakeholders' pain points must be a priority so that you can strategically link the cyber strategy to key business objectives.

Another scenario to consider before taking on a new CISO role is that you cannot guarantee your company will not suffer a successful cyber attack within the first 100 days. Therefore, establish relationships with external incident response teams in advance before you need to quickly engage them.

▌Initiation Phase: Days 0 – 15

To get off to a good start, take time to align with your direct reporting managers on key challenges and opportunities, and discuss the vision for information security. Familiarize yourself with the organizational structure and reporting lines, especially in legal, safety, risk, compliance, HR, operations, and governance teams. Now is the time to start building relationships with key stakeholders to coordinate efforts to build and manage the business information security program.

During the first few weeks, analyze the cyber strategy to understand current maturity. This means analyzing previous risk assessments, threat hunting reports, gap analyses, and security roadmaps (if they exist). Also request organizational security policies and audit reports, as well as access to any risk management tools.

While diving deep into the company's cyber maturity status, take the time to schedule meetings and introduce yourself to key stakeholders. Hold regular risk management meetings with appropriate stakeholders to discuss the risk profile of the business, laying the groundwork for discussing the status of any undisclosed or unaddressed risks.

Within this timeframe, identify your key security vendors and establish communication. Your main security vendors can assist with gap analysis.

Cyber does not exist in a bubble. You can look for like-minded people, those who face the same challenges as you, to find your "tribe". It is highly likely that someone has already dealt with or is dealing with the challenges you face. Collaborating with industry peers can be a powerful approach.

▌Understanding Phase: Days 0-45

It is often said that if you don't know where you are going, you won't know when you get there. Without a strategy, it is impossible to develop a meaningful action plan, and businesses will continue to implement temporary solutions that hinder overall integration.

During the first month and a half, focus on understanding projects and programs specific to security and compliance. Based on the current overall maturity status, existing security plans, key controls deployment, and primary risks, determine which tasks need to be prioritized. Take time to understand the business's incident response capabilities, its top 10 business-critical applications, and their respective threat models.

A robust cybersecurity program is built on effective information security governance, so start by understanding the roles and responsibilities of organizational information security governance. Make sure you have a clear understanding of which roles are responsible for decision-making, which roles should be kept informed, and which roles in the network should be consulted.

Crucially, verify that reasonable security practices are in place to support strategic organizational goals and risk management, and verify that the enterprise can effectively and efficiently prevent attacks.

Review the company's information security charter to understand its security vision, security mission, and cybersecurity scope, as well as which departments must comply.

One of your critical tasks must be to identify the business's critical business data or "crown jewels" (such as information about customers, intellectual property, product designs, and financials) and current security controls. Keep a register and prioritize non-negotiable controls to secure all critical assets (for example, ensuring all databases are encrypted).

Since supply chain and third-party risks are at the heart of many recent breaches, take the time to understand if third parties host the organization's critical assets and review contracts to familiarize yourself with their responsibilities and how well they meet their security obligations.

To get a fresh perspective on your approach, identify and build a relationship with at least one internal and external executive mentor. External mentors from different industries can provide unbiased advice and out-of-the-box thinking.

One of the primary responsibilities of a CISO is information security risk management, so understanding how risk propagates within the company should be a top priority within the first month. Take time to understand how risks are categorized (risk taxonomy) and ranked.

▌Prioritization Phase: Days 15-60

Now is the time to focus on prioritizing activities, developing a shared vision with your manager, team, and key stakeholders, and gathering feedback to refine your plan.

Start by building a business-aligned, risk-aware, and comprehensive information security strategy that enables you to clearly communicate the company's information security risk profile. Consider combining control frameworks that meet multiple compliance requirements by testing individual controls.

From a control perspective, utilizing a consolidated security architecture allows for better execution of a holistic approach that includes protection for cloud, network, and endpoints, and also allows for comprehensive user access, all powered by a single management and security operations platform. This means having all logs speak the same language, providing visibility and situational awareness through a single dashboard that generates reports automatically. This approach is a game-changer, solving many of the obstacles faced by CISOs and security teams.

Over the next two months, align with your direct reports and stakeholders on at least three key issues. These will be your quick wins—projects that yield significant impact on the cybersecurity program with minimal effort. Quick wins will help gain credibility early on, ensuring the CISO's plans receive support from higher-ups.

Another quick win is to prioritize customized security awareness and education training across the enterprise. This activity can easily be outsourced and is an important first step in building an awareness-driven culture where everyone in the company understands that cybersecurity is everyone's responsibility. Be sure to use the results of security awareness training to demonstrate the maturity of the cybersecurity awareness culture.

To execute an information security program, you will need funding. At this stage, plan the operational security budget for the coming months and get an early understanding of the staffing required.

▌Execution Phase: Days 30-80

By now, you should be making active progress toward achieving quick wins—focusing on the three most pressing issues, resolved through established corporate security architecture principles—integrated by design rather than stacked.

This is the time to perform tabletop exercises. As part of the tabletop exercise, ensure the involvement of all key stakeholders, including executives, public relations teams, HR teams, legal teams, and the SOC team. This is an opportunity to demonstrate and educate executives on the potential impact of a successful cyber attack. Tabletop exercises are best conducted through an experienced third-party incident response team with a track record of handling complex APT cases.

During this phase, you should also lead security-related governance forums and cyber steering committees, focusing on eliminating waste, addressing key blind spots, maximizing the value of cybersecurity investments, and ensuring rapid time-to-value. The cyber steering committee should consist of a cross-functional team with domain expertise and business stakeholders, all with clearly defined roles, responsibilities, and scope.

After completing a thorough understanding of the current state and gap analysis, focus on executing the game plan to achieve the desired state, taking into account the controls and processes that must be prioritized to address current and emerging risks with high probability and business impact.

▌Results Phase: Days 45-100

As the 100 days draw to a close, if implemented, this framework will begin to bear fruit and show progress. The best way is to use metrics related to business objectives. There is no need to jump straight into highly technical metrics. Much value can be gained from metrics that track behavior, such as the percentage of employees who have completed security awareness training.

Measure progress against the top five results of the 100-day plan, as this will help you and the business determine which strategies are working and which are not, so that inefficiencies can be resolved quickly.

When reporting to executives and the board, remember that bad news does not get better over time. Be sure to highlight any project risks as part of daily exercises, because executives do not like surprises. Clearly outline the risk scenarios, likelihood, impact, risk mitigation plans, and potential additional costs.

At the end of the 100 days, aim to report on the following questions:

• What is our current capability maturity?

• What are the greatest threats facing the organization?

• Which part of the security posture requires the most urgent attention?

• What resources are needed to counter the threats that would cause the most harm to the organization?

• How does the executive team wish to report on the effectiveness of cybersecurity investments?

• What is the risk to the organization if nothing changes?

Lastly, remember that to succeed as a CISO, you must win the hearts and minds of key stakeholders. The Cerberus Security Measurement and Verification Platform can fully assist you. By replicating real APT attacks, it uses visualized charts to let executives intuitively understand cybersecurity defense capabilities, clearly recognize the value and ROI brought by security, and have a quantitative understanding of the company's current defense level. At the same time, you can also effectively recognize the gap between security construction planning/expectations and actual results, providing a quantitative basis for future decision-making. The security operations team can also continuously evaluate the defense capabilities of key infrastructure and application deployments, optimize protection configurations and incident response processes, and enhance defense effectiveness.

| Reference Source

https://www.cybertalk.org/2022/11/18/a-cisos-100-day-run-to-cyber-success/