The course aims to highlight the importance of the board of directors as a powerful and influential security team within an organization. It focuses on the challenges faced by CISOs in engaging with the board effectively and provides strategies for CISOs to support and advise the board on security matters. The course teaches skills such as negotiating access to the board, building relationships with stakeholders, sharing information effectively, and communicating risk in the context of the business. The teaching method includes in-depth interviews, case studies, and practical tips. This course is intended for CISOs, security professionals, and individuals looking to enhance their understanding of the relationship between security teams and the board of directors.
Overview
Syllabus
THE ADVANCED COMPUTING SYSTEMS ASSOCIATION
Security Teams
Determine risk tolerance
Most boards lack cybersecurity expertise
Many CISOs don't know how to effectively engage the board
Gartner CISO Coalition
Purpose
In-depth interview field study
The 'CISO' title doesn't grant credibility
Credibility can be built through engagement
Don't wait to be called on
Tips
Negotiate access to the board
Understand what makes each board member tick
Build relationships with stakeholders
COO CIO CEO CFO HHR
Share information with board members
Pre-arm the CEO with information
How to communicate with the board?
Explain risk in context of the business
"They don't care about my vulnerability management project. They really don't." CISO
Don't use fear
Security 101
Set realistic expectations
The reason they didn't gain that is because they couldn't. They didn't speak the business language. ... They spoke the technical language and it just created a barrier that they couldn't speak at the level of the board and what the board wanted to hear. CISO
The power of the board and CISO working together
Increase attention from C-suite
Back up the CISO
Take-aways
1. The CISO title isn't enough
2. Virtuous cycle of board engagement
Boards can become an immense resource for CISOS
Taught by
USENIX Enigma Conference
