Navigating the Cybersecurity Career Path

CHAPTER 22How Do I Talk About My Security Program?

Summary

• Start with a story: Use data and benchmarks to support your story, but don't lead with them.
• Focus on the future: The past is history. Focus on what you need today and tomorrow. Build on the past only if it helps your future story.
• Communicate well and often: Control the narrative; otherwise, people will create their own.

When we become leaders of a security program, we usually come to the role with no training on presenting a business case or sharing the work of the security program with the organization. It doesn't occur to most of us how much we would need to have this skill. Wouldn't the program just speak for itself? Short answer: no.

For some of us, our first instinct is to use metrics to talk about our programs. We search for “security metrics” or go to security analyst websites or conference talks about metrics. Board members, chief financial officers (CFOs), and other metrics-driven people need metrics. There is a completely valid school of thought that says, “You cannot manage what you cannot measure.” A great book on this topic is How to Measure Anything in Cybersecurity Risk by Douglas Hubbard and Richard Seiersen.

Over time, I found the metrics approach to be insufficient. It certainly worked in some places, like when asking for more money from the CFO, but often it was too weedy for everyone else. No one cared, really, about how old our vulnerabilities were, how many vendor products we had ...