CISO MindMap 2023: What do InfoSec Professionals Really do?

Most people outside the Cybersecurity profession don’t fully realize and appreciate the complexity of a security professional’s job. Since 2012, CISO MindMap has been an effective educational tool to communicate CISO responsibilities and has enabled security professionals to design and refine their security programs. Here is the latest and updated CISO MindMap for 2023 with a number of updates and new recommendations for 2023-24.

Download PDF Version for better printing quality

What has changed?

With time, the responsibilities of security professionals are only increasing. Why? Technology is changing fast, bringing new ways of doing business, continuous adoption of Cloud, and many emerging technologies like ChatGPT phenomenon with many vendors working on similar solutions. Not only the Infosec professionals are “expected” to deeply understand these technologies, but also provide policies/guidance on how to secure them. For this reason, every year you find new things on the CISO MindMap. Like every year, few things are added, changed or removed from the CISO MindMap depending upon their relevance. Modified and new items are marked in red color for your convenience.

Other changes include but not limited to:

  • Automation – A section on “Automation” is added after re-organizing some existing content and adding new. Given efforts of optimization of budget by many CISOs and lack of qualified staff, automation is key to remove routine tasks and find efficiencies in security operations. I believe every security team must create a specific role for automation
  • Redundancy and Overlaps – Remove some redundancies and overlaps
  • Expiration Date – A common issue is that many professionals still have older CISO MindMap copies. I added an “expiration date” to let people know when they should stop using a particular version. The expiration date for the 2023 CISO MindMap is the end of June 2024. The next version will be published before the current version expires.

Recommendations for 2023-2024

Every year I make my recommendations as a practitioner and based upon conversations with infosec leaders. I try to be objective, avoid the hype, need for adoption in the next 12-18 months, and solely focus on what data and research shows. While there may be some unintended biases, the objective is to provide actions that can be taken in a short to mid range time period. These are not “predictions” of the future but rather “what is needed now” to strengthen security programs.

For me, the most difficult part while making these recommendations is to pick as few as I can. The following list is longer than what I would like it to be but hopefully it would give you a few things to think about. The followers of MindMap would quickly realize that some of these are the same as previous years and some new ones.

  1. Increase Attention on Resilience – Evaluate ransomware defenses, detection and response capabilities, perform a business impact analysis and identify critical processes, applications and data. Test ability to restore systems and data within an acceptable time frame. Understand that merely having a backup is not enough. Ability to rebuild impacted systems and restore backups in a timely manner is crucial to bring business back to normal operating conditions after security incidents.
  2. Reduce and Consolidate Security Tools – More security tools don’t necessarily reduce risk but do add the need for maintaining expertise on security teams. While deciding which tools to keep or retire, think about functionality overlap, future direction, innovation on the part of vendors
  3. Build a Brand for Security Team – While the message is important, the credibility of the messenger is also crucial. To serve business better, train security team staff on business acumen, value creation, influencing people without authority, and human experience. I included this recommendation last year as well and we need to keep focus on the fact that information security teams don’t live in a vacuum and have to enable business and interact with others. 
  4. Untangle Application Web of Components – Modern applications have become a web of interconnected components, APIs, multiple cloud and data centers, open source libraries, third party services like DNS, email, content delivery vendors, and so on. Even when you purchase a commercial off the shelf application/software, it may rely on third party APIs and services. Understand how business applications work, take an inventory of all components that they rely on, and make it part of your vulnerability management program.
  5. Build Expertise in Emerging Technologies – By now everyone has heard about ChatGPT and competing technologies from other vendors. Build team expertise in technology fields including machine learning (ML) models, model training, API security, service mesh, containers, DevSecOps.
  6. Create a Security Automation Role – Managing security program cost and working at “machine speed” requires automation. This is a new section added to CISO MindMap this year. Automate maintaining a risk register, asset (hardware, software, APIs, etc.) inventory, scanning and testing. Many tools used in CI/CD pipelines as part of DevOps are useful for automation. However, simple scripting goes a long way in reducing overhead of routine tasks. I would highly recommend automating security metrics such that you can see the current state of your security program anytime you need to, almost in real time. It is not an easy task but it is doable. I have observed some organizations do it on scale.

I am eager to listen to your viewpoint on these recommendations, why or why not!

How to use CISO MindMap?

It is unbelievable how many posts and messages I see about many different ways people are using the CISO MindMap. Over the years, it has become a great tool for many of you and I appreciate your feedback, suggestions for improvements. Following are some of the ways this MindMap is quite helpful:

  • Have you been asked what you really do as a security professional? The CISO MindMap is one way for answering the question and explaining it to people. I have heard from many professionals that this MindMap is extremely helpful in explaining the complexity of a CISO job, especially to a business audience.
  • A means for guiding conversation with other technology professionals.
  • SANS Institute uses it as part of the Security Leadership Poster.
  • Designing and refining security programs.
  • Some security vendors use the MindMap for awareness.
  • CISO group discussions and/or community meetings.
  • For aspiring security professionals, understand the landscape and decide their career path.
  • An educational and awareness tool.

Obviously there is a lot on this MindMap. The stress on people who have these responsibilities is real. If nothing else, this MindMap should help leaders recognize that stress and do something about it. I covered this topic (stress) in my latest book Cybersecurity Arm Wrestling: Winning the perpetual fight against crime by building a modern Security Operations Center (SOC) as well.

What do they say?

Many security leaders and professionals have made comments on LinkedIn about CISO MindMap and how they use it. Following is a sample of some of these comments with links to original posts on LinkedIn.

Jesper Bork Olsen said:

Interested in understanding the role of a CISO? Today, reflecting on the past weeks of intensity, curiosity and just overall well invested energy, I enjoy looking through the newly updated CISO mindmap that Rafeeq Rehman continues to maintain both from a relevance, recommendations and a reminding perspective. 

If you’re in the #cybersecurity field you will have seen the #CISO mindmap for sure, and if you are a senior leader, that haven’t had the pleasure yet or are curious as to what a CISO actually considers in the everyday life, I strongly recommend spending time on this – I guarantee there are topics on there that can inspire a vivid conversation with the board in almost any organization! If nothing else, share the 6 recommendations with your cybersecurity team and see if it’s a match for you too 😉

For me personally, the Mindmap has served as a great source of inspiration from the very first version several years ago – thank you Rafeeq Rehman for your continued contributions to the community!!”

Rodolphe Simonetti said:

“My friend Rafeeq Rehman recently released the 2022 version of the CISO Mindmap – always a great reference.”

Dan Maslin Wrote:

“Another year, another update to the CISO MindMap by Rafeeq Rehman.  Looks like in 2022 we’ve added another dozen or so areas of responsibility for the CISO (unsurprising and yes it is unrelenting), these are shown in red.

Published now for over a decade, I find these CISO MindMaps incredibly useful to explain (maybe to ourselves at the very least) the breadth and complexities of the roles that CISOs and cyber security teams undertake.”

Martin tePoele says:

I ran across the CISO MindMap recently and was quite impressed.”

David Howell says

Landed on a great resource for anyone interested in better understanding the incredibly complex scope of responsibilities under a CISO. The CISO Mind Map (courtesy of Rafeeq Rehman) puts it all into perspective. It’s one thing to say “CISOs have a lot on their plates” – but another thing to see it in black and white. The CISO Mind Map is also useful in terms of thinking about how the many discrete activities and programs may be organized.


In addition to numerous infosec leaders who provide their input, we have a LinkedIn Group to gather suggestions and comments from the community. While many provided feedback, the following is an alphabetically organized list of people and organizations who provided “specific suggestions” for improvements. If I missed anyone, please send me a message to make corrections.

Your input is highly appreciated!

Copyright © Note

This MindMap is copyrighted material. However it is absolutely free to all (like water and air) with no strings attached (as long as it is not altered and not used to make money). When using this MindMap, please cite the source properly so that recipients can receive future updates.

Subscribe to my blog

To keep updated about new posts, you can subscribe to my blog

Recent Posts

Posted in cisomindmap, Leadership | Tagged , , , , , , | Comments Off on CISO MindMap 2023: What do InfoSec Professionals Really do?

A New CISO’s TODO List

When a CISO joins a new organization, it is important to start with basics. Following is a TODO list for every new CISO.

  1. Understand the business – where revenue comes from, who are major customers, meet internal stakeholders.
  2. Review CISO budget – How much is the budget, where it is spent (people, technology, services).
  3. Know team members – Get to know team members. In case of a large team, get to know key leaders but meet individual contributors to understand their challenges.
  4. Identify compliance and regulatory needs – Before creating strategy, list all compliance needs, their current status, next audit cycle timeline.
  5. Understand technology foundation
    1. Policy, standards and governance structure.
    2. Critical assets and asset management (what to protect).
    3. Identify key technologies used for protection (end point, network, applications, Cloud, Identity and access management).
    4. Security operations, threat detection, incident response
  6. Key vendors – Contact key vendors and identify how to get their help.
  7. Develop Strategy and Metrics – What needs to be done to build a security program, risk management strategy, and how to measure progress.
  8. Security team branding – Create a plan for marketing and branding of the security team.

Subscribe to Blog

Posted in InfoSec, Leadership | Tagged | Comments Off on A New CISO’s TODO List

A Conference Dedicated to Security Operations Center (SOC)

Credits Pixabay

As shown in CISO MindMap 2023, job of security professionals is complex and Security Operations Center (SOC) is a significant part of this job. SOC analysts are stressed out by overwhelming number of incidents and dealing with these incidents in a timely manner. While there are so many security conferences every year, working on my latest book “Cybersecurity Arm Wrestling – Winning the perpetual fight agains crime by building a modern Security Operations Center (SOC)” made me convinced that a dedicated event is needed to focus only on topics related to a SOC.


Benefit from experiences of SOC practitioners, crowdsourcing SOC best practices.

Main Focus Areas

Following are the major areas of focus that should be part of a SOC conference.

  1. SOC in the Cloud, SOC as a Service
  2. SOC – Meaningful Performance Metrics
  3. SOC Staff: Well being and stress management
  4. Use of Artificial Intelligence in SOC
  5. SOC for IoT, OT, Autonomous Vehicles and other emerging industry needs
  6. Implication of Cloud, Containers, Serverless Computing on SOC
  7. Threat visualization, Threat Intelligence
  8. Cooperative SOC for vertical markets
  9. Automation
  10. Open source SOC
  11. Incident Response, Digital Forensics
  12. Business case development, planning and implementation and cost management
  13. Emerging SOC technologies
  14. Global SOC challenges, privacy laws, data sharing across physical boundaries
  15. Integrations, APIs, Ticketing Systems
  16. Knowledge Management

With expanding sources of data and ever-evolving new threats, we, as industry need to continuously work on finding the best path forward. The objective of this conference is to do exactly that by challenging the status quo and bring fresh and original thoughts to meet new challenges.

Who Should Speak?

Speakers at this event should be only those who are SOC practitioners in some form so that they can bring real world experience to the audience.

Delivery Mode

To enable global community, the conference should be virtual so that participants can join/present from anywhere without the need for traveling.

Call to Action

Interested? Connect at LinkedIn and explore this idea further –

Subscribe to Blog

Email subscription will deliver new posts to your inbox.

Posted in SOC | Tagged , , , | Comments Off on A Conference Dedicated to Security Operations Center (SOC)

Life Principles

Life Principles Rafeeq Rehman

This post is an updated version of six fundamental principles that always fill my professional and personal life with joy, pleasure and satisfaction. So here they are!

  1. This is my first model of a joyful life, explained to me by a senior school friend. If you do this, you will never regret anything from the past, career choices, business decisions or personal relationships. It takes a lot of courage, but you will have a contented heart all the time.
  1. “Your value” is directly proportional to the value you create for others. Measure your actions by how much they benefit others, whether it is a business meeting, a family dinner, or social media post. Always serve the people around you.
  1. There is no perfect time to launch a product, start a business, pursue a degree, or change career. You will never have perfect information to make important decisions. Embrace imperfection, “good enough” is much better than “perfect”.
  1. Be generous in your praise of people, in sharing credit, in kindness, in forgiving, in giving favors. Be a giver. Be generous with people who disagree with you. Giving favors is the best investment for your career and your personal life.
  1. Complexity is the biggest enemy at work, home, in relationships, and with friends. Be simple, do simple things, have simple ideas, simplify things for people. Be single threaded to improve productivity. Use images, diagrams, and analogies to explain complex things.
  1. Fear of failure keeps people from achieving great things and miss career opportunities. Fail; if you have not failed in a long time, you have very likely missed many opportunities. Overcome the fear of failure, you don’t have to prove anything to anyone. Abandon your comfort zone. Success and failure are two sides of the same coin, one does not exist without the other.

Subscribe to Blog

Recent Posts

Posted in Leadership | Tagged , | Comments Off on Life Principles

Risk Assessment – On Estimating Control Strength

In a previous blog post, I discussed qualitative, quantitative, and scoring methods of risk assessment. Irrespective of which method we use, estimating “control strength” is an important part of calculating overall risk (especially in qualitative and quantitative methods). To improve consistency and to decrease subjectivity in estimating control strength, I am providing some examples of how to estimate control strength in this article.

What is a Control and Control Strength?

A “control” is something that reduces the potential of a loss. Controls can be implemented in many forms. It could be a technical control (e.g. a firewall), a process control (e.g. change management process), an administrative control (e.g. a visitor log), or in some cases a person (like a security guard). 

Simply put, control strength is the ability of a control to stop/resist cyber attacks from threat actors, resist compromise and protect an asset’s confidentiality, availability and integrity.

Categorizing Control Strength

Control strength can be categorized in different levels. Using five levels for control strength is very common. Following is one way to describe these levels but there could be other ways to do so.

  1. Very High (VH) – The control will protect against top threats
  2. High (H) – The control will protect against majority of threats
  3. Moderate (M) – The control protects against average threats
  4. Low (L) – The control protects only very low .level attacks
  5. Very Low (VL) – The controls is not effective at all and would rarely protect against any threats

Having these categories at hand, a risk analyst can determine control strength during the process of risk analysis in a more consistent manner.

Estimating Control Strength

Risk analysts need to make an estimate about control strength during the risk assessment process. This estimate could be based upon data (which is difficult to acquire in the information security field) or it could be based upon experience and knowledge of the analyst. Following are some examples of how to estimate control strength in different scenarios. These could be used for education purposes.

Scenario 1 – Protecting data in a web application with help of user authentication and making it available to only authorized users.

Following can be one way of estimating control strength levels:

  1. Very High (VH) – A user has to use a combination of username and password along with two factor authentication. The password must be strong with a minimum length of 10 characters and a combination of alphabets, numbers and special characters. Passwords expire after a certain time forcing the user to change it. A user is notified via email when password change occurs.
  2. High (H) – A user has to use a combination of username and password. The password must be strong with a minimum length of 10 characters and a combination of alphabets, numbers and special characters. Passwords expire after a certain time forcing the user to change it. A user is notified via email when password change occurs.
  3. Moderate (M) – A user has to use a combination of username and password. The password must be strong with a minimum length of 10 characters and combination of alphabets, numbers and special characters.
  4. Low (L) – A user has to use a combination of username and password but is able to use a password of any length and no requirement of special characters.
  5. Very Low (VL) – No username and password is required. A user can get to data as long as the user has a specific URL.

Scenario 2 – Protect physical security of a data center

  1. Very High (VH) – Boundary wall with locked gates, presence of 24×7, surveillance cameras, security guard on duty, visitor log register, keycard access to datacenter room with biometric retina scan, camera inside the data center with face recognition technology that can identify unknown people.
  2. High (H) – Boundary wall with locked gates, presence of 24×7, surveillance cameras, security guard on duty, visitor log register, keycard access to datacenter room.
  3. Moderate (M) – Boundary wall with locked gates, security guard on duty, visitor log.
  4. Low (L) – Boundary wall with locked gates. Visitors with a key can enter the building.
  5. Very Low (VL) – Room inside a building with no locks.

Other Considerations 

Here are few other considerations while dealing with control strength estimation.

  • We don’t need all five levels of controls for each scenario. In some cases, we may have three or four levels of controls, e.g. Very High, Moderate, and Low.
  • The exact definition of each level of controls can vary from one organization to another but should comply with and be consistent with a single standard inside that organization.
  • The risk management leadership should train risk analysts on a continuous basis. The training should be about  how to measure control strength by walking them through new scenarios each time. An example could be a monthly open meeting to pick one scenario and explain rationale for control levels.

Subscribe to Blog

Recent Posts

Posted in Risk Management | Tagged | Comments Off on Risk Assessment – On Estimating Control Strength

Risk Assessment – Qualitative, Quantitative and Scoring

Information security community has been performing risk assessment for as long as the profession existed. The risk assessment is  typically classified as qualitative (e.g. Critical, High, Medium, Low) or quantitative (a dollar amount). Risk scoring is a relatively new phenomenon where a score (number) is assigned based upon available data and numerical calculations. Scoring system and method could be very different depending upon a particular method. For example, you may see scores between certain ranges in one system and scores without range in others.

Why is methodology important?

Business outcomes may be different depending upon which methodology we pick. Each method has its advantages and drawbacks.

  1. Qualitative methods usually incorporate some level of subjectivity based upon the risk assessor’s experience. However it could be done with relatively ease and at high speed, taking less time for completion.
  2. Quantitative risk assessment methods do involve more complicated math. Since large sets of data are not available, the risk assessors still make some assumptions in the inputs giving an impression of subjectivity. Implementing quantitative risk assessment “at scale” is difficult as it takes more time to perform.
  3. Risk scoring methods differ quite a bit in their implementations. Many vendors are not transparent about their underlying formulas used for scoring. However, methods exist to perform risk scoring based upon available data instead of assumptions. The main advantages are eliminating subjectivity and ability to perform risk scoring at scale.

A decent risk assessment methodology could be a combination of qualitative, quantitative and scoring methods.

What factors to consider?

When considering which risk assessment methodology to adopt, following are a few considerations.

  1. Staff experience in performing risk assessment.
  2. Speed at which risk assessment is needed.
  3. Tools available for risk assessment.
  4. Ability to collect data for risk scoring. The data may include vulnerability scanning, endpoint detection and response systems (EDR) data, penetration testing results, patch management data, asset management, coverage of security agents (or lack of it) and so on. The more data is available, the better the score.

My personal preference is to use risk scoring in combination of qualitative risk assessment performed in assessments like penetration testing.

Subscribe to my blog

Recent posts

Posted in InfoSec | Tagged , , | Comments Off on Risk Assessment – Qualitative, Quantitative and Scoring

Four Questions CISOs Should Ask Themselves Everyday

Four CISO Questions

While there is a huge list of CISO responsibilities as we discussed in CISO Mindmap, keeping oneself focused on value creation and security program improvements is not easy. The following four questions will help improve efficiency of the program by automation and picking right problems to solve.

  1. How can we automate this?
  2. Is this problem worth solving?
  3. Will this enable business or add value?
  4. What incremental improvement can we make today?

While my focus is information security community, these questions are relevant for all knowledge workers and leaders irrespective of their field of work.

Recent Posts

Subscribe to Blog

To keep updated with latest posts, please subscribe to this blog via email.

Posted in Entrepreneurship, Leadership | Tagged , | Comments Off on Four Questions CISOs Should Ask Themselves Everyday

Software Bill of Material and Vulnerability Management Blind Spots

Open source software is everywhere (which is not a bad thing in itself). However, many buyers don’t have inventory of open source components included in software products they are buying. Business even fail in keeping tack of open source components used in internally developed applications. As a result, vulnerability management programs have blind spots.

Take an inventory of open source software (standalone and libraries) and make it part of your vulnerability management program.

Why it matters:

  1. Use of open source software is not bad in itself. Everyone uses open source software. The biggest examples are Linux and Apache server.
  2. Many commercial software vendors use open source components but don’t properly and adequately disclose all open source components included in the commercial products.
  3. Recent vulnerabilities (e.g. log4j) have far reaching impact.
  4. Software applications developed in-house also include open source components. As these applications age and the initial developers move on to new jobs, older and vulnerable open source components may still stay in the applications unnoticed for long time.

What to do:

  1. It is crucial to have an up-to-date inventory of all open source software, whether used as standalone products or embedded as a library inside a product. We can’t manage if we don’t know its existence.
  2. Require your software vendors to provide you with a list of all open source libraries and their versions embedded into their products.
  3. Make this list part of the vulnerability management program. Monitor release of new vulnerabilities and patches for your inventory of open source software components.

When building a bill of material for open source components, it is imperative to not only contact your software vendors but also review all software applications developed in-house. In some cases you may use source code scanning tools to build inventory of these components.

Subscribe to Blog

Recent Posts

Posted in InfoSec, Open Source | Tagged , | Comments Off on Software Bill of Material and Vulnerability Management Blind Spots

Podcast: CISO MindMap and Recommendations for 2022-23

Recently we recorded a podcast with CISO Tradecraft focusing on CISO MindMap 2022 and recommendations for 2022-23.

As a reference the latest CISO MindMap is available here and detailed recommendations page is also available here. You can listen to the podcast shown below. Thanks to G Mark Hardy and Ross Young to make this happen and leading this podcast series.

Following is a list of my published books, in no particular order.

Cybersecurity Arm Wrestling: Winning the perpetual fight against crime by building a modern Security Operations Center (SOC)

And don’t forget to subscribe this blog using link below to keep updated with new posts.

Recent Posts

Posted in InfoSec, Leadership, SOC | Tagged , , , , | Comments Off on Podcast: CISO MindMap and Recommendations for 2022-23

EBK-Cybersecurity: Understanding Stock Market Terminology

Basic Stock Market Terminology for CyberSecurity Professionals and Why Should They Care!

June 26, 2022 – Rafeeq Rehman

The role of InfoSec professionals has morphed into a critical business function. One should expect getting involved in “business” discussion often, and at increasing higher levels of business structure up to board of directors. Understanding and speaking business language is more important than ever for the success of any InfoSec professionals.

As mentioned in my last post, I have started building body of knowledge for Essential Business Knowledge (EBK) needed for Cybersecurity professionals. The first domain on this body of knowledge is “Essential Business Terminology for InfoSec Professionals”. This post covers some of these terms related to stock markets, where to get this information, and why InfoSec professionals should care. The following diagram shows terms only in one category (Stock Market).

Domain 1 – Essential Business Knowledge (EBK) – Stock Market Terminology

Stock Markets

A very large number of information security professionals work in publicly traded companies. Company stakeholders (shareholders/investors, company executives, employees who own company stocks) have keen interest in performance of the company in the stock market. They use “stock market language” in business meetings and risk discussions.

Information security professionals should develop foundational understanding of the stock market to understand these discussions and to become a productive part of the conversation. 

Where to get stock market information?

Stock market data is available online from many resources. In the United States, you can get the latest data from one of the following (and many other) resources.

  • Yahoo Finance (
  • Google Finance (

Public and Private Companies

For-profit commercial businesses typically fall into two categories: public and private. Public companies are those which are traded in a stock markets where any investor can buy or sell their shares/stocks. Private companies, on the other hand, are owned by a limited number of shareholders and these are not traded in the stock market.

Where to get stock market information?

  • Public companies are required to comply with many laws and regulations which are not applicable to private companies. Infosec professionals working in public companies are often involved in compliance, monitoring, and investigation activities.

Stock Ticker

Ticker is a symbol assigned to each company traded in the stock market. For example ticker for Apple Inc is AAPL, for Cisco it is CSCO, for Palo Alto Networks PAN and so on. There are usually multiple stock markets in each country with their own ticker symbols for stocks that are traded on those stock markets.

Why should infosec professionals care?

  • Stock tickers are commonly used in business conversations. You should know the stock ticker of your own company as well as tickers of major competitors.
  • Many APIs are integrated into corporate applications that use stock tickers. Infosec professionals may be engaged in security assessment of applications and APIs.
  • Applications used to track public sentiment and breaking news in social media also use ticker symbols. Some security operations centers may be using this information for real time awareness.

Market Capitalization

Market capitalization, also known as market cap, is the total value of a company calculated by multiplying stock price with number of outstanding stocks.

Market capitalization = share/stock price x total number of shares outstanding 

  • Market cap is a measure of a company’s worth as viewed by investors in the stock market.
  • Market capitalization is frequently used to show growth or decline of a company in financial terms.
  • Market cap is used to put businesses in categories. For example, companies with market capitalization larger than 10 billion are called large-cap companies.

Why should infosec professionals care?

  • Sometimes infosec professionals need market capitalization in risk calculations.
  • Impact on market cap after significant data breaches is an important metric.

Initial Public Offering or IPO

Initial public offering, also known as IPO, is the process by which a new company starts trading in a stock market. IPO is a very important event in the life of startup companies. After an IPO, the general public can invest in company stocks.

Investment banks help private companies establish their valuation and take them to the stock market. IPO established the initial market capitalization of a company. A ticker symbol is also assigned at the time of IPO.

Why should infosec professionals care?

  • An IPO is an important milestone for a company.
  • Companies may face elevated threat activity at the time of IPO intended to gather and sell financial data.

Insider Trading

Some people inside any company have access to financial information that is not available to the public for trading (buying or selling stocks). Insider trading  is when these individuals use or share this information for trading company stocks. All insider trading is not illegal. There are certain rules for the individual with insider knowledge to trade company stocks. Their trade of company stocks is legal as long as they abide by these rules.

Sharing insider information to outside entities is also a crime and there are strong penalties, including jail time, for people caught in such activity.

Why should infosec professionals care?

  • Some infosec professionals, as part of their investigation work, may get access to financial information not available to the public. In that case they should check with the internal legal/ethics team to understand if insider trading rules apply to them.
  • You may be asked to do an investigation (DLP systems, logs reviews, etc.) to determine if an individual(s) is involved in insider trading.
  • You may be responsible for risk assessment of financial systems and implement security controls to limit access.

Security and Exchange Commission – SEC

Securities and Exchange Commission, also known as SEC (, is a US government agency with responsibilities to regulate stock markets, ensure fairness, stop illegal insider trading and investigate cases where it suspects market manipulation.

Why should infosec professionals care?

  • For public companies, complying with SEC regulations is crucial. Infosec professionals are usually involved in designing, implementing, and monitoring controls for SEC compliance.
  • SEC controls may involve data retention, access to certain data, monitoring communications of individuals and certain roles (e.g. traders).

What About Other Terms?

I know all of the terms are not covered in this post. However this provides the reader about what they expect when we expand other subcategories including:

  • General Management Terms
  • Budgeting and Financing
  • Sales and Marketing
  • User Experience
  • Legal and Compliance

Stay tuned!

Subscribe to My Blog

Recent Posts

Posted in EBK-Security | Tagged , , | Comments Off on EBK-Cybersecurity: Understanding Stock Market Terminology