The paranoid CISO

It is often said that for information security, the absence of failure does not mean success. Put it another way the security team has to be constantly vigilant and always watching for the current and next threat that may come our way. Just because there is no noise on our security sensors does not mean we are not under attack. Enter the ever-vigilant and paranoid CISO.

Paranoia is a good thing when used constructively to build a proactive security posture. Every CISO needs to have a paranoid element to their persona. A good and healthy dose of paranoia, when not taken to the extreme, leads to a never-complacent attitude and an environment of continuous improvement.

The paranoid CISO because of the non-complacent paranoia will be more successful than most. This paranoid CISO is not going to live an incident-free life, but will encounter breach incidents like most of us. However this CISO is more likely the one whose team will discover the intrusion earlier than the rest or will proactively recognize and head off a security incident before it occurs or will build a more resilient security program than most.

[ 10 common misconceptions about security professionals ]

So what makes you a paranoid CISO?

Here are 10 key elements for healthy paranoia in an information security leadership role:

1. Believe totally in defense-in-depth and are constantly looking for areas in which to add new and effective layered controls that align with risk mitigation objectives or emerging threats
2. Continually looking to add additional instrumentation to widen scope and depth of coverage for existing controls
3. Always monitoring the sensor network with eyes on the system and review of controls
4. Looking continually for ways to better inspect and correlate data from multiple sensor streams
5. Paying special and close attention to application security for those critical business applications with confidential and private data, that transcend much of the layered security
6. Constantly seeking to understand the business better, so as to improve and refine the information security risk assessment
7. Stay constantly on top of the vendor risk process and management to ensure that vendor access to confidential and private data is managed and controlled
8. Always working with the business to better leverage relationships for pushing the security agenda and to create informal channels for security awareness throughout the business
9. Constantly staying abreast of new business enabling disruptive technologies and evaluating potential security impact before the business use case shows up for security review
10. Never losing sight of the fundamentals..like always patching..patching..patching

Many of the older Cold War era movies and comic books featured spies constantly looking over their shoulders and watching their back. Yes, the paranoid CISO is all of that and more. Not only does the paranoid CISO need to look out for the enemy within and behind, but the CISO has to constantly probe the horizon for what’s coming, while at the same time, staying in lock-step with the business . . . all of this while trying to get a good night’s sleep.

George Viegas is a C level security executive in the banking industry.