Category Archives: InfoSec

CISO MindMap 2020: Summary of Recommendations for Updating Security Programs

Cybersecurity is a complicated business. Many people outside this profession don’t fully realize and appreciate the complexities of the job. CISO MindMap is an effort to educate public about Cybersecurity professionals’ job responsibilities. The MindMap also enables Cybersecurity professionals design … Continue reading

Posted in InfoSec | Tagged , , , , , , | Comments Off on CISO MindMap 2020: Summary of Recommendations for Updating Security Programs

CISO MindMap 2020: What do InfoSec professionals really do?

Most people outside Cybersecurity profession don’t fully realize and appreciate the complexity of security professionals’ job. I have been publishing and updating this MindMap for many years, not only as an effective educational tool but also enable professionals use this … Continue reading

Posted in InfoSec | Tagged , , , , , | Comments Off on CISO MindMap 2020: What do InfoSec professionals really do?

CISO Tools to Build (or Tweak) a Cybersecurity Roadmap, Create Business Case and Request Funding

I am not telling you anything new when I say that an essential part of a CISO’s job is to build a Cybersecurity program, communicate it to stakeholders, and continuously tweak it based upon continuously changing threat landscape. Job of … Continue reading

Posted in InfoSec, Leadership | Tagged , , , , , , , | Comments Off on CISO Tools to Build (or Tweak) a Cybersecurity Roadmap, Create Business Case and Request Funding

A 3-3-4-5 Model for CISO Strategy

Many CISOs and Infosec leaders I meet face continuous challenge to communicate their strategy that is simple and others in their organization can understand and relate to. I have created a simple model for CISOs to explain it on a single page and have found it to be an effective tool. Continue reading

Posted in InfoSec, Leadership | Tagged , , | Comments Off on A 3-3-4-5 Model for CISO Strategy

A Threat Modeling Process to Improve Resiliency of Cybersecurity Program

Many organizations with mature Cybersecurity program have implemented controls to safeguard their digital assets. However, controls can give a false sense of security as many times mere existence of a control does not mean that it is (a) adequate and/or (b) effective. Protecting crown jewels requires continuous monitoring and evaluating controls. This article describes a 5-step threat modeling process to improve resiliency of your program, identify gaps and close these gaps. Continue reading

Posted in Digital Transformation, InfoSec, Leadership | Tagged , | Comments Off on A Threat Modeling Process to Improve Resiliency of Cybersecurity Program

Verizon White Paper: CISO’s Guide to Cloud Security

Verizon security recently published a white paper titled “CISO’s Guide to Cloud Security: What to know and what to ask before you buy” that points out five steps to help decision making on purchasing Cloud products and services. For each step, the white paper also provides recommendations to consider. This is a summary of this white paper. Continue reading

Posted in InfoSec | Tagged , , | Comments Off on Verizon White Paper: CISO’s Guide to Cloud Security

CISO MindMap 2019: What Do InfoSec Professionals Really Do?

Note: An updated version of this article is available now. Please click here to go to CISO MindMap 2020 version. Just like other areas of information technology, information security landscape continues to change at a fast pace. The updated CISO … Continue reading

Posted in InfoSec | Tagged , , | Comments Off on CISO MindMap 2019: What Do InfoSec Professionals Really Do?