Skip to content

Security leadershipSecurity operations

The CISO career is under control.

Strategy, resilience, and a seat at the table. This is what the career looks like. All three still applied at 02:17.

Triangle of Success and a confident CISO on their first day: empowered people, aligned process, enabling technology, ending in security excellence.

Triangle of Sadness and the same CISO a year later, on-call and exhausted: never enough people, endless process, too many tools, and breached anyway.

Cyber Wire →

Triangle of SuccessTriangle of Sadness

People. Process. Technology.

Aligned, measurable, under control. Never enough. Never heard. Never funded.

Triangle of Success: Skills, Attitudes and Knowledge combining into the path to excellence.

Triangle of Sadness: people never heard, endless process, too many tools, and breached anyway.

Fig. 1. The operating model, as designeddeployed

The CISO Manifesto · LTS

We are uncovering better ways of keeping systems secure by doing it.

Principles for keeping things securerunning.

Working security over security theatre.Please demonstrate that the control is working.
Simple controls over complicated tooling.There are currently 47 of them.
Maintained systems over endless replacement.Version 37.0.0.69.jaguar or above.
Risk reduction over risk reporting.The report is due before the patch.

Keep Maintaining Software: Windows 11, macOS Sonoma and Ubuntu 24.04 LTS all reporting up to date, secure and supported. — Software has entered its maintenance era.Security has apparently entered it too.

Stop Maintaining Software: the same three systems mid-update, with complaints about semantic versioning and a request to backport security patches to the LTS release. — Software has entered its maintenance era.Security has apparently entered it too.

The job description

As advertised.

Verbatim from the CISO postingincident bridge.

01
Executive visibilityEveryone knows your name now.
02
Strategic leadershipStrategic incident response, mostly at night.
03
Risk-based decision makingRisk accepted. Again.
04
Trusted advisorCalled first when everything catches fire.
05
24/7 security operationsOne person answering the phone.
06
Security cultureTraining completed. Password still shared.
07
Risk visibilityKnown. Accepted. Forgotten.
08
Incident readinessAsk them when the incident starts.
09
Empowered security teamTwo people resigned last month.
10
Healthy work–life balancePager says otherwise.
11
Continuous improvementPatch next quarter.
12
Meaningful impactNobody will ever know what didn't happen.

Field notes

The team.

Dave, 27, on his first day in DFIR:

Dave, 28, one year into DFIR:

"I finally have a seat at the table.""And on the bridge call."

Maya, 41 · CISO

"I wanted a career where every day was different.""Mission accomplished."

Dave, 2728 · DFIR

"We shift left.""The ticket moved. The deadline didn't."

Alex, 34 · AppSec

"Our evidence is comprehensive.""The screenshot is dated March."

Sam, 39 · GRC

Cyber Wire

Today in cyber.

Regulation clocks, exploited CVEs, and the decisions that got deferred. Until now.

Read the dispatches →Read the evidence →