Like last year, ransomware continues to be a major issue for many organizations. One of the best things any organization can do to itself is to prepare for dealing with ransomware incidents. While ransomware is morphing into crypto currency mining in some cases, this is not the only major concern on security professionals’ mind as new technologies are emerging fast. From autonomous vehicles, blockchain, to drones to connected medical devices, security professionals are called to provide guidance/advice, frameworks, monitoring and incident handling to enable the business with these and many other technologies. All of this is making skills development a continuous and major challenge.
While other professions in technology has to focus primarily in their particular domain, the security professionals are expected to know it all.
Given these changes and challenges in the overall technology field, I have updated the CISO MindMap for 2018 which is the 10thversion since its initial publication. Major changes are highlighted in red color so that users of version 9 (2017) can easily see the updates and adapt.
Download PDF file by clicking here
Skill Development & Emerging Technologies
Like last year, I would recommend focusing on learning the emerging technologies (augmented reality, blockchain, machine/deep learning, computer vision, autonomous vehicles and others). I can’t emphasize enough how important it is to enable your business with emerging technologies instead of standing in the way of progress. InfoSec professionals should not only be learning these technologies but should also be creating guidelines for using these technologies (proactively). You should be thinking about how to get logs and other data to identify threats, integrate with SOC, and deal with incidents. Many freeoptions for learning new skills are available form MOOC providers like Coursera and Edx.
Automation and Productivity
As the workload for security operations professionals is ever increasing, I would also emphasize to focus on automation and increasing productivity. New options are available to perform automatic threat hunting, anomaly detection, prioritization and others. Use of open source technologies and scripting should be an essential part of security operations. I would suggest having at least one person on your teams with excellent Python or other scripting language skills.
GDPR, Data and Privacy
Compliance with GDPR (General Data Protection Regulation) and data privacy is just a start and we can expect that more regulations like that will follow. Knowing what data is being collected, where it is stored, how it is utilized and secured are some of the key issues to understand for compliance with privacy regulations. The security professionals should be proactively training and guiding IT teams about data privacy, integrate with DevOps processes, and be an agent of change about how data is handled. At the same time, we need to be mindful that data is the new currency for our businesses and must be capitalized on and used as competitive edge.
Last, I want to thank all who have provided feedback and suggestions about how to improve the MindMap. The names are so many that I can’t include all of you but you know who you are. I wanted to let you know that your suggestions are very welcomed and much appreciated. Enjoy the new MindMap and don’t forget to send me a note about how it is helping you in advance your goals and objectives!
May 21, 2018.
Your feedback is very important to me. Please share your thoughts on my Twitter handle at @rafeeq_rehman. Also please subscribe to my blog using your email address at the top-right corner “subscribe” option.
References
