‘What are the challenges that you faced in your first 100 days in your cyber security role, and what influenced your approach?’
This was one of the questions posed to Insignia Financial CISO James Ng, AISNSW Cyber Security and Infrastructure Advisory Services Manager Marcus Claxton, and Sekuro Cyber Resilience Program (CRP) and Operational Technology (OT) Principal Consultant Nicolas Brahim, by Sekuro Bid Manager Audrey Jacquemart in a fireside chat held during Sekurokon 2024.
The session seeks to pick the brains of these cyber security leaders – learning about the challenges they face, and how they prioritise and attain sponsorship of their cyber security roadmaps. Sharing context from both smaller and large organisations, these industry veterans discuss budgeting, relationship building, and general advice for any aspiring CISO (chief information security officer).
James Ng
CISO, Insignia Financial
Marcus Claxton
Manager, Cyber Security and Infrastructure Advisory Services, AISNSW
Nicolas Brahim
Principal Consultant, CRP & OT, Sekuro
Audrey Jacquemart
Bid Manager, Sekuro (Moderator)
Watch the full discussion below or read on to see how these cyber security leaders paved the way for their organisation to follow them and their strategies.
TABLE OF CONTENTS
- What are the challenges that you faced in your first 100 days in your cyber security role, and what influenced your approach?
- When it comes to setting up the key initiatives and the top priorities, what are the things that you focused on and why?
- What are the strategies that you use to align cyber security with the business objectives?
- What does your success look like at the end of your 100 days?
- Do you have any advice for any new aspiring CISOs in the room?
‘What are the challenges that you faced in your first 100 days in your cyber security role, and what influenced your approach?’
James:
Within a week, a multi-year cyber security strategy was approved, establishing a vision and objectives. The follow up work was then to plan the execution of the strategy, and what key initiatives are needed. The next few weeks were spent meeting as many people across the organisation, as well as the regulatory stakeholders, in order to understand the context, and “why things are the way they are”.
Marcus: Marcus spoke about his role as director of IT in a previous school, and the initial cultural challenge. When he first arrived, the team was prioritised on the technology used by the school, sometimes without regard for the users. Marcus proceeded to establish clear expectations with the IT team, following his “start as you wish to continue” maxim in life.
Like James, Marcus also sought to meet with stakeholders in the school, to assess what was effective or not, and to personally build rapport through a personal connection. Similarly, conversations were had with the executive team, to be aligned with what expectations they had for the IT department, as well as Marcus’ reporting responsibilities.
Marcus also had to address the challenge of managing with existing capabilities and available resources. Concluding that the current ratio for IT staff to endpoints was too low to viably plan or execute strategies or innovations on top of maintenance, Marcus sought to find a suitable vendor partnership to fill in the skills gaps.
Marcus also noted that prior to his tenure, most schools had never done an ethical hack, and how it took him three years before he could get both the approval as well as the funding to do so.
Nicolas: Nicolas added that the first steps would be to understand one’s position, and then establish the top three to five priorities. Agreeing with James and Marcus, Nicolas talked about the importance of conveying to users that the team’s role is to support their day-to-day operations, not to make their life more difficult. Thus, forming good relationships is necessary.
Similarly, getting an endorsement from the board comes foremost. After all, “you can have the best strategy in the world, but if you don’t have the buy-in from the board and the budget, it just is a PDF that you have in your computer for three years”.
You can have the best strategy in the world, but if you don't have the buy-in from the board and the budget, it just is a PDF that you have in your computer for three years.
‘When it comes to setting up the key initiatives and the top priorities, what are the things that you focused on and why?’
Marcus:
- Data governance is important for organisations such as schools, where there is so much data, the lack of structure and labelling would be a real problem.
- Getting approval and funding from the board for cyber security requires convincing them – especially if they lack technical experience – that cyber security is an organisational risk, not an IT problem. It’s not about getting value for money; if we get hacked, the teaching and learning stops.
- The propensity for schools to want to innovate and experiment is a real challenge, especially around shadow IT and the IT team’s efforts trying to contain things while still fostering innovative practices.
It’s not about getting value for money; if we get hacked, the teaching and learning stops.
Nicolas:
- The non-technical discussions in getting the buy-in from from the board and trying to explain the ROI in cyber security.
- Understanding the role of cyber security needs to be a foundation across the organisation, from the board to new hires, and setting up training opportunities to increase awareness is a priority.
- When the organisation onboards a new system, it is important to communicate with the users that cyber security is working with them, not against them, and that the new, additional steps in the process like multi-factor authentication (MFA) are all about helping the business reach its objectives.
‘What are the strategies that you use to align cyber security with the business objectives?’
James: James has a cyber security strategy on a page that establishes a link to the business strategy. On a more micro level, KPIs set within the cyber security team are purposefully aligned with the CTO’s, KPIs, as well as business and enterprise-level KPIs.
“So that way we’ve got alignment, we’ve got clarity, we’re all rowing in the same direction and focusing on the things that matter not only to us from a security perspective but also to the rest of the organisation.”
Insignia, being the amalgamation of three organisations, James notes that there are always issues surfacing, and so prioritisation of issues, as well as tech consolidation, remain relevant strategies.
So that way we've got alignment, we've got clarity, we're all rowing in the same direction and focusing on the things that matter not only to us from a security perspective but also to the rest of the organisation.
Marcus: Marcus agreed, and added that whenever he raised a business case that required spending, he would outline exactly how the business case aligned with the school’s strategic intent or actions. He would also spell out the potential impact of the business case with regard to the school’s priorities, in this case, child protection, teaching, and learning. This outline would be drafted in a way that could be understood by non-technical readers, even if it were to address cyber security and zero trust concepts.
Nicolas: Nicolas discussed how in the absence of a sufficient budget to afford comprehensive cyber security, most organisations can still try to get by with a solid identity security, with good password policies and MFA, setting up a solid foundation and then work on improving and maturing existing control after.
‘What does your success look like at the end of your 100 days?’
Nicolas: Nicolas opined that getting the board of directors to buy in was proof of translating the technical risks into business risks. Thereafter, it’s a matter of establishing risk prioritisation, and figuring out what are the initial steps, since it was not realistic to expect a five year strategy and budget to be set up and approved within the first hundred days.
James: James agreed, talking about establishing a “plan for the plan” being a realistic goal for the first hundred days. He warned about anyone in that position having the temptation to try to impress and jump into the pitfall of making knee-jerk or pre-emptive calls that may not be good for the organisation’s long-term strategy.
Marcus: Marcus also agreed that a hundred days is a short period of time, and that his measure of success within that period is gaining the trust of the stakeholders within the organisation.
‘Do you have any advice for any new aspiring CISOs in the room?’
“Get some sleep.”
“Any technical career is amazing and when you are involved in any sort of technical support, whether it's cyber security or whether it's just keeping the lights on, there is pressure, but there is great reward as well. Be prepared to do the hard yards and enjoy the ride.”
“Any technical career is amazing and when you are involved in any sort of technical support, whether it's cyber security or whether it's just keeping the lights on, there is pressure, but there is great reward as well. Be prepared to do the hard yards and enjoy the ride.”
“Understand that you can't solve everything on your own.”
“You need to partner not only with the board, but with the rest of the teams in your organisation, as well as external partners. Understand that there's going to be a lot of change and roadblocks, and to just take each step one at a time.”
“You need to partner not only with the board, but with the rest of the teams in your organisation, as well as external partners. Understand that there's going to be a lot of change and roadblocks, and to just take each step one at a time.”
“Cyber security/information security is one of those unique areas where it's not a point of competition, it's a point of collaboration – not just for CISOs but in any leadership role within a security function.”
“It can sometimes be lonely. Be steadfast, be optimistic, and remember you've got not just your team, your colleagues, your peers around you, but a whole community around you that's really supporting you and and I don't think I've ever had an issue reaching out to people whether it's in this room or beyond to ask for help or support get some advice. Especially for smaller organisations where often it is sort of the the Atlas model of security with the world on your shoulders, make sure you tap into the community because it's a vibrant, growing and welcoming one, and a testament to the space that we work in.”
