Five Critical Mistakes New Cyber Chiefs Should Avoid


CEO and Co-Founder of Cyber Leadership Institute, a fast-growing community of cyberleaders from more than 50 countries.

The growing list of egregious cyberattacks continues to push the demand for chief information security officers (CISOs). As the demand for cyber chiefs rise, so do salaries. According to the 2022 survey by Heidrick & Struggles, an executive search firm, companies must be willing to fork over nearly $1 million in total compensation package to attract a high-quality CISO.

But through my company’s work training hundreds of cyber leaders from more than 50 countries, I’ve found that a significant proportion of new CISOs fail to make immediate impact, while some fail completely. Five key mistakes stand out for their impact.

1. Overreliance On Technical Skills

Predictably, most cyber leaders hail from technical backgrounds. But as new CISOs quickly discover, technical skills are a small part of the job. The technical competencies that earned them praise in functional roles are ill-suited to command respect from executive peers and lead complex change. If they fail to detach from operational tasks, “techie” CISOs abdicate their leadership and strategy execution responsibilities. Without the C-suite and board on their side, their cybertransformation programs are quickly thrust into rough waters.

I once heard of a CISO who spent weekends bunkered in a data center configuring internet proxies and security alerting tools. The result was predictable: The CISO wasn’t visible to executive committees, got burned out and the team felt disempowered.

As the ISACA’s 2022 State of Cybersecurity Survey brings to light, there is rising demand for innovative CISOs with proven leadership skills, strategic thinking and the ability to take smart risks. This reality may be uncomfortable but must be faced. To boost chances of success, new CISOs must proactively nurture deep relationships with decision makers and translate complex technical matters into business language, while empowering their direct reports to make key technical and operational decisions.

ALSO READ:  Twitter Circle Is Finally Live…And Other Small Business Tech News This Week

2. Changing What Already Works

Overtaken by excitement, some new CISOs make the strategic mistake of attempting big changes too quickly. This is more likely if the CISO is an external hire, with little visibility into existing political dynamics or technical constraints.

A new CISO I collaborated with made this career-derailing move. Soon after stepping into a new role, the CISO engaged a global consulting firm to draft a fresh road map based on “industry best practice.” But a few months prior, the board had already approved a solid strategy developed by the previous CISO. When the CISO presented their rushed strategy, everyone was rattled, especially fellow executives who thought the new CISO should have known to consult widely before wasting time and resources. The new CISO’s leadership team, most of whom had worked with the previous CISO, felt disrespected and ganged up to undermine the new strategy.

New cyber leaders often seek to make their mark through bold acts. But without a delicate balance, hasty changes can create fault lines that lead to mistrust, lost credibility and resentment. Offset this common trap by slowing down and building key stakeholders’ perspectives into cybersecurity strategies. With a strong shared sense of purpose, stakeholders are more likely to throw their weight behind cybertransformation programs.

ALSO READ:  CEO Conferences That Can Help With Growth In 2023

3. Feeding Their Insecurities

The fear of failure drives some new CISOs toward irrational behavior. They fall into the perilous trap of hiring direct reports who pose no threat to their positions, who conform and do as they are told. By leaving critical strategy execution, leadership or board communications exposed, this irrational behavior creates fertile ground for inefficiencies, backbiting, project delays and costly mistakes.

Winning CISOs, on the contrary, develop self-awareness and use proven competences as a yardstick for building high-performing teams. They unlock the power of diversity by hiring individuals who compensate for their weak spots, amplify their strengths, fearlessly challenge assumptions and openly embrace opposing perspectives. Getting this right requires not only self-awareness but courage and humility.

4. Neglecting Hearts And Minds

When drafting strategies, some new CISOs are enticed to focus on flashy concepts—zero-trust tools, defense against zero-day threats, machine learning algorithms, etc. But by placing exaggerated faith in technical solutions, they overlook the people and change management aspects of transformation. Most cybersecurity projects—data loss prevention, mobile device management, multifactor authentication and others—require staff to fundamentally alter their entrenched habits and ways of thinking. Forcing users outside their comfort zones without careful planning turbocharges resentment, undermining the potential of security investments.

Leading CISOs put people’s hearts and minds, not technology, at the center of their strategies. They hire experienced change managers to work closely with the technical teams to identify the pain points new solutions will introduce, anticipate cultural resistance challenges and implement a raft of measures to smooth things over. By empowering the program manager with key decision points, they free up time to manage key stakeholders, mentor direct reports and deeply engage the board.

ALSO READ:  Implementing Sustainability Into The Hospitality Industry

5. Positioning Cybersecurity As A Necessary Evil

The primary role of most CISOs is to mitigate risks. But solely focusing on risk mitigation positions cybersecurity as a traditional cost center with a very weak link to broader business goals. Without a compelling mission, new CISOs often struggle to enlist the support of the board and executives—a prerequisite for success. Consequently, the CISO’s views are quickly shot down and their budget requests hit brick walls, making them feel like glorified systems administrators.

To succeed, new CISOs must ruthlessly tie cybersecurity budget requests to business goals. For example, take SOC 2 Type 11 reports, globally accepted independent reports on the effectiveness of an organization’s controls relating to data security/availability, processing integrity, confidentiality and privacy. A proposal to move the organization toward SOC 2 certification that highlights the goal of accelerating reviews by prospective clients is more likely to obtain funding than a proposal that simply asks to improve compliance.

Forging Ahead

It’s not that technical skills are unimportant, but in my experience, CISOs who make immediate and lasting impact do so by connecting deeply with key stakeholders, positioning cybertransformation as a business enabler and carefully managing complex change. They also place people’s hearts and minds, not technology, at the center of everything they do.


Forbes Business Council is the foremost growth and networking organization for business owners and leaders. Do I qualify?




Source link

admin

Nigerian Celebrity News and entertainment

Follow Us

Follow us on Facebook Follow us on Pinterest